{"id":2225,"date":"2015-12-01T23:19:58","date_gmt":"2015-12-01T23:19:58","guid":{"rendered":"https:\/\/www.process.st\/templates\/information-security-incident-response\/"},"modified":"2024-04-25T13:08:39","modified_gmt":"2024-04-25T13:08:39","slug":"information-security-incident-response","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/information-security-incident-response\/","title":{"rendered":"Information Security Incident Response"},"content":{"rendered":"\n<section id=\"introduction\">\n <h2>Introduction:<\/h2>\n <div class=\"image-content\">\n  <figure>\n   <a href=\"https:\/\/ps-attachments.s3.amazonaws.com\/ab9a10dd-f176-42ae-b183-19c443f80904\/gJ7eXdzeqO30UyTUh25D2A.png\" alt=\"Introduction:\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/ps-attachments.s3.amazonaws.com\/ab9a10dd-f176-42ae-b183-19c443f80904\/gJ7eXdzeqO30UyTUh25D2A.png\"> <\/a><!-- No caption -->\n  <\/figure>\n <\/div>\n <div class=\"text-content\">\n  <p>The worst has happened and the apocalypse is here! Your security's been breached and it's time to spring into action to do some damage control.<\/p>\n  <p class=\"style-blockquote\">\"<em>The number of security breaches has increased, the scale and cost has nearly doubled. Eleven percent of respondents changed the nature of their business as a result of their worst breach<\/em>\" - <a href=\"http:\/\/www.pwc.co.uk\/\" rel=\"nofollow noopener\" target=\"_blank\">PWC<\/a>'s <a href=\"http:\/\/www.pwc.co.uk\/services\/audit-assurance\/insights\/2015-information-security-breaches-survey.html\" rel=\"nofollow noopener\" target=\"_blank\">2015 Information security breaches survey<\/a><\/p>\n  <p>Never fear! We here at <a href=\"http:\/\/process.st\/\" rel=\"nofollow noopener\" target=\"_blank\">Process Street<\/a> have come up with your very own information security incident response.<\/p>\n  <p>From assessing and containing the damage to making sure that it doesn't happen again, follow these steps from the get-go of your incident response to ensure that you don't become a heavy statistic in an annual breach survey.<\/p>\n  <p>Let's begin!<\/p>\n <\/div>\n<\/section>\n<section id=\"initial-response\">\n <h2>Initial response:<\/h2>\n<\/section>\n<section id=\"input-personnel-details\">\n <h2>Input personnel details<\/h2>\n <div class=\"text-content\">\n  <p>To begin with, you'll need to<strong> input basic information<\/strong> such as names, dates and email addresses of the personnel involved with the incident response process.<\/p>\n  <p>Timing is crucial at this point, so go ahead and <strong>fill in the form fields below.<\/strong><\/p>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Which customer has been affected? <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Michaela's Marketing Office\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Lloyd's Legal Firm\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Arianne's Architecture &amp; Design Firm\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Martin's Medical Office\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      5\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Andrew's Accounting Firm\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Executive-level customer email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Systems administrator email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Human resources email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Department director email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Law enforcement email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Government agency email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Media representative email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Triage analyst email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Forensic analyst email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Threat researcher email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"email-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Additional contact email address <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n<\/section>\n<section id=\"perform-preliminary-incident-analysis\">\n <h2>Perform preliminary incident analysis<\/h2>\n <div class=\"text-content\">\n  <p>Damage assessment is the key to your information security incident response!<\/p>\n  <p>First up,<strong>&nbsp;consider the nature of the incident,&nbsp;<\/strong>in terms of exactly what happened, and exactly what was affected.<\/p>\n  <p>Continue on and<strong>&nbsp;complete all of the form fields below&nbsp;<\/strong>to kick-start the response protocol.<\/p>\n <\/div>\n <div class=\"date-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> When were you notified of the incident? <\/label>\n   <div class=\"date-container\">\n    <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button>\n   <\/div>\n  <\/div>\n <\/div>\n <div class=\"date-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> When did the incident occur? <\/label>\n   <div class=\"date-container\">\n    <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button>\n   <\/div>\n  <\/div>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> What kind of security breach occurred? <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     External\/removable media\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Impersonation\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Attrition\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Web\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      5\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Email\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      6\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Improper Usage\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      7\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Other\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Incident type <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Port scanning activity\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Malware infection\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Denial of service attack\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Unauthorized access (e.g. intrusion\/hack)\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      5\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Insider breach\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      6\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Destructive attack\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      7\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Other\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"alert-response-team-of-incident\">\n <h2>Alert response team of incident<\/h2>\n <div class=\"text-content\">\n  <p>One of the first steps following an information security incident is to<strong> notify everyone in the response team, including external resources,<\/strong> to begin company protocol for activating the response plan.<\/p>\n <\/div>\n<\/section>\n<section id=\"identify-legal-obligations\">\n <h2>Identify legal obligations<\/h2>\n <div class=\"text-content\">\n  <p>Depending on the nature of the breach, you may have to meet certain legal requirements.<\/p>\n  <p><strong>Be sure to carefully review both federal and state regulations<\/strong> with regard to your specific industry, as well as the type of data involved and the nature of the incident.&nbsp;<\/p>\n  <p>You will also need to <strong>make sure you are clear on exactly who needs to be notified<\/strong>, i.e. your customers, employees, law enforcement, media, government agencies, etc. and <strong>make sure that these notifications occur within any specified timeframes.<\/strong><\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Federal regulations reviewed\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     State regulations reviewed\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Will additional personnel need to be notified? <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Yes\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     No\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"determine-who-needs-to-be-notified\">\n <h2>Determine who needs to be notified<\/h2>\n <div class=\"text-content\">\n  <p>You may have to notify additional personnel as part of legal proceedings, or if certain sensitive information has been compromised.<\/p>\n  <p><strong>Select from the drop-down field<\/strong> to determine who else needs to be notified of the incident.<\/p>\n <\/div>\n <div class=\"multi-choice-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Who else needs to be notified of the incident? <\/label> <select disabled class=\"form-control\"> <option value=\"\">Multiple options can be selected from this list<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Law enforcement\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Media\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Employees (internal)\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Government agency\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      5\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Customer\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"damage-control\">\n <h2>Damage control:<\/h2>\n<\/section>\n<section id=\"secure-the-premises-around-the-affected-area\">\n <h2>Secure the premises around the affected area<\/h2>\n <div class=\"text-content\">\n  <p>When a breach occurs, the premises of and around the affected area should be secured and <strong>access should be limited to as-needed only<\/strong> in an effort to preserve evidence.<\/p>\n  <p><span>To this end, you should limit access to contaminated computers and server rooms, keeping the doors locked and making sure to notify staff and site security which areas&nbsp;are off limits.<\/span><\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Inform staff and site security which areas are off limits\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Be sure entrances and exits are secured and monitor access to the building\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Enforce sign-ins and sign-outs if not already in place\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"scan-for-compromised-machines\">\n <h2>Scan for compromised machines<\/h2>\n <div class=\"text-content\">\n  <p><span>Though full remedial action on compromised machines should be left until after the forensic investigation, steps should be taken to understand the extent of the breach as<\/span>&nbsp;quickly as possible.<\/p>\n  <p><strong>Scan the remaining computers in the network for indicators of compromise associated with this outbreak<\/strong> (e.g. MD5 hashes).<\/p>\n <\/div>\n<\/section>\n<section id=\"disconnect-compromised-systems-from-network\">\n <h2>Disconnect compromised systems from network<\/h2>\n <div class=\"text-content\">\n  <p><strong>Systems containing sensitive data should be disconnected from the main network<\/strong>, including local intranet as well as internet until the incident has been resolved.<\/p>\n  <p>After being disconnected from the main network,<strong> compromised systems&nbsp;should be preserved and left untampered<\/strong> in preparation for a full forensic investigation.<\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Disconnect computers with access to sensitive information from main network\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Preserve compromised machine states for forensic investigation\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"backup-all-critical-systems-data\">\n <h2>Backup all critical systems data<\/h2>\n <div class=\"text-content\">\n  <p>During a system compromise,&nbsp;<strong>critical systems data should be backed up&nbsp;<\/strong>onto secure offline databases.<\/p>\n  <p>In doing so, <strong>agents should be careful not to tamper with the state of compromised machines,<\/strong> and <strong>the backup process should be thoroughly documented<\/strong>, including how the backup was performed, and by who.<\/p>\n <\/div>\n <div class=\"text-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> First name of agent performing systems backup <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"text-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Last name of agent performing systems backup <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"textarea-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> How was system backup performed? <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n <\/div>\n <div class=\"date-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> When was system backup performed? <\/label>\n   <div class=\"date-container\">\n    <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button>\n   <\/div>\n  <\/div>\n <\/div>\n<\/section>\n<section id=\"preserve-all-system-and-application-logs-and-states\">\n <h2>Preserve all system and application logs and states<\/h2>\n <div class=\"text-content\">\n  <p>You must now make an effort to&nbsp;<strong>preserve all company system and application logs <a href=\"https:\/\/www.process.st\/it-security-processes\/\" rel=\"nofollow\">for later reference and review<\/a><\/strong>.<\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Archive all data to a secure off-site system.\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Document all actions taken, by whom and when\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Record all forensic tools used\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"enact-web-server-safeguard-protocol\">\n <h2>Enact web server safeguard protocol<\/h2>\n <div class=\"text-content\">\n  <p><span>If you've been subject to a direct denial of service (DDoS) attack,&nbsp;you should <strong>enact your&nbsp;server safeguard protocol immediately<\/strong> to prevent further damage.<\/span><\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Configure web servers to protect against HTTP and SYN flood requests\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Coordinate with your ISP to block source IP addresses\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"monitor-the-system-for-signs-of-continued-access\">\n <h2>Monitor the system for signs of continued access<\/h2>\n <div class=\"text-content\">\n  <p><span>Working closely with your ISP (internet service provider), <strong>d<\/strong><\/span><strong>etect, monitor and investigate unauthorized access attempts<\/strong> \u2013 with priority on those that are mission-critical and\/or contain sensitive data.<\/p>\n  <p><span><strong>Identify the privileged user accounts for all domains, servers, apps, and critical devices <\/strong>and then ensure that monitoring is enabled for all of these systems (including system events).<\/span><\/p>\n  <p class=\"style-warning\"><span>Sometimes a DDoS is used to divert attention away from another more serious attack attempt.<\/span><\/p>\n  <p><span><strong>Complete the sub-checklist&nbsp;below<\/strong> to ensure system monitoring is properly put in place.<\/span><\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Correspond with your ISP\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Identify and monitor privileged user accounts\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Increase system surveillance\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Investigate unauthorized access attempts\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"check-ip-address-reputation-score\">\n <h2>Check IP address reputation score<\/h2>\n <div class=\"text-content\">\n  <p>If an unidentified actor was attempting to gain access to company systems, <strong>run a reputation check against their IP address.<\/strong><\/p>\n  <p>Tools like AlienVault's <a href=\"https:\/\/www.alienvault.com\/open-threat-exchange\" rel=\"nofollow\">Open Threat Exchange<\/a> are very useful databases of IP reputations and should be the first port of call when investigating a rogue address.<\/p>\n  <p><span>If this database yields no results, then<strong>&nbsp;try looking up the&nbsp;<\/strong><\/span><strong><a href=\"https:\/\/whois.net\/\" rel=\"nofollow\">WHOIS<\/a>&nbsp;information for the offending domain. <\/strong><\/p>\n <\/div>\n<\/section>\n<section id=\"incident-investigation\">\n <h2>Incident investigation:<\/h2>\n<\/section>\n<section id=\"determine-whether-incident-has-been-resolved\">\n <h2>Determine whether incident has been resolved<\/h2>\n <div class=\"text-content\">\n  <p>Has the incident been resolved? This is crucial in determining the nature of the response.<\/p>\n  <p><strong>Fill out the form fields below<\/strong> with the current incident status.<\/p>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Has the incident been resolved? <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Resolved\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Unresolved\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n <div class=\"text-content\">\n  <p>Based on your response to the form field above,<strong> provide some additional context<\/strong> as to how the incident was resolved (if it was), or what the main issue is with regard to any ongoing problems&nbsp;(if it wasn't).<\/p>\n <\/div>\n <div class=\"textarea-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Incident status notes <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n <\/div>\n<\/section>\n<section id=\"determine-the-impact-of-the-incident\">\n <h2>Determine the impact of the incident<\/h2>\n <div class=\"text-content\">\n  <p><strong>Examine logs, audit <\/strong>trails<strong> and data<\/strong> to find out if any <strong>sensitive information<\/strong> was involved in the incident. <strong>Record your findings<\/strong> in the <strong>form field<\/strong> below.<\/p>\n <\/div>\n <div class=\"textarea-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Which data has been compromised? <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n <\/div>\n <div class=\"textarea-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Provide comments on damage to systems <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n <\/div>\n <div class=\"text-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> What was the duration of system downtime? <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"text-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> What was the estimated financial loss? <\/label> <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Determine severity of the attack <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     High\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Medium\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Low\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Unknown\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n <div class=\"select-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Determine sensitivity of data involved in the incident <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     High\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Medium\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Low\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     Unknown\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"provide-suggestion-for-customers-best-course-of-action\">\n <h2>Provide suggestion for customer's best course of action<\/h2>\n <div class=\"text-content\">\n  <p>Given what you know so far about the incident, you must <strong>provide a suggested course of action for your customer<\/strong> if their data was compromised.<\/p>\n  <p>The specific course of action will vary depending on whether or not the incident has been resolved, but be sure to <strong>take into consideration legal obligation&nbsp;<\/strong>and <strong>plan with the most recent <a href=\"https:\/\/whatis.techtarget.com\/definition\/threat-intelligence-cyber-threat-intelligence\" rel=\"nofollow\">threat intelligence<\/a> in mind.<\/strong><\/p>\n <\/div>\n <div class=\"textarea-field-content form-field-content\">\n  <div class=\"form-group\">\n   <label> Suggested best course of action based on incident report <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n <\/div>\n<\/section>\n<section id=\"communications\">\n <h2>Communications:<\/h2>\n<\/section>\n<section id=\"alert-law-enforcement-of-the-incident\">\n <h2>Alert law enforcement of the incident<\/h2>\n <div class=\"text-content\">\n  <p>Should the incident be severe enough to warrant law enforcement involvement, the relevant <strong>law enforcement individuals should be contacted and informed immediately.<\/strong><\/p>\n <\/div>\n<\/section>\n<section id=\"enact-federal-data-breach-notification-procedure\">\n <h2>Enact federal data breach notification procedure<\/h2>\n <div class=\"text-content\">\n  <p>Your client should be reminded of their obligation to take appropriate action as defined by the Health Information Technology for Economic and Clinical Health (HITECH) act in response to a breach of confidential patient healthcare data.<\/p>\n  <p><strong>Inform your client<\/strong> that all affected patients must be notified that their data has been compromised in a timely manner.<\/p>\n  <p class=\"style-warning\">As with any case of sensitive confidential data leakage, the protocol for proper response should be carefully examined - be sure you are educated on both local and federal regulations.<\/p>\n <\/div>\n<\/section>\n<section id=\"inform-upper-management-of-the-incident\">\n <h2>Inform upper management of the incident<\/h2>\n <div class=\"text-content\">\n  <p>Now that a more thorough investigation has taken place, you should have more information to update management, so you can <strong>forward an email summarizing your findings.<\/strong><\/p>\n  <p>The details filled out in the checklist so far will be automatically added to the template below, so all you need to do is <strong>check everything looks okay<\/strong> before sending it off.&nbsp;<\/p>\n  <p class=\"style-warning\"><span>Only those with a valid need-to-know should be included in communications regarding key incident details, indicators of compromise, adversary tactics, and procedures.<\/span><\/p>\n <\/div>\n<\/section>\n<section id=\"inform-the-customer-of-leaked-sensitive-information\">\n <h2>Inform the customer of leaked sensitive information<\/h2>\n <div class=\"text-content\">\n  <p>If<strong> sensitive customer data<\/strong> was involved, <strong>contact the customer<\/strong> about the incident.&nbsp;<\/p>\n  <p class=\"style-danger\">Businesses generally have 60 days to notify individuals of a data breach, assuming notification is required by law and that no other varying circumstances are at play. This time period starts from the moment the breach was discovered.<\/p>\n <\/div>\n<\/section>\n<section id=\"sources\">\n <h2>Sources:<\/h2>\n <div class=\"text-content\">\n  <ul>\n   <li><a href=\"http:\/\/www.pwc.co.uk\/\" rel=\"nofollow noopener\" target=\"_blank\">PWC<\/a>&nbsp;-&nbsp;<a href=\"http:\/\/www.pwc.co.uk\/services\/audit-assurance\/insights\/2015-information-security-breaches-survey.html\" rel=\"nofollow noopener\" target=\"_blank\">2015 Information Security Breaches Survey<\/a><\/li>\n   <li><a href=\"https:\/\/www.onpage.com\" rel=\"nofollow\">Onpage<\/a> - <a href=\"https:\/\/www.onpage.com\/the-ultimate-msp-incident-response-guide\/\" rel=\"nofollow\">Ultimate MSP Incident Response Guide<\/a><\/li>\n   <li><a href=\"https:\/\/www.cbsit.co.uk\" rel=\"nofollow\">CBSIT<\/a>&nbsp;- <a href=\"https:\/\/www.cbsit.co.uk\/2016\/09\/23\/types-cyber-security-breaches-common\/\" rel=\"nofollow\">Common Information Security Breaches<\/a><\/li>\n   <li><a href=\"https:\/\/www.alienvault.com\/\" rel=\"nofollow noopener\" target=\"_blank\">AlienVault<\/a> - <a href=\"https:\/\/www.alienvault.com\/resource-center\/ebook\/insider-guide-to-incident-response\/types-of-security-incidents\" rel=\"nofollow\">Types of InfoSec Incidents<\/a><\/li>\n   <li><a href=\"https:\/\/www.vita2.virginia.gov\/\" rel=\"nofollow noopener\" target=\"_blank\">Vita2<\/a> - <a href=\"https:\/\/www.vita2.virginia.gov\/security\/incident\/secureCompIncidentForm\/threatReporting.cfm\" rel=\"nofollow\">Information Security Incident Response Form<\/a><\/li>\n   <li><a href=\"https:\/\/www.sans.org\" rel=\"nofollow noopener\" target=\"_blank\">Sans<\/a> - <a href=\"https:\/\/www.sans.org\/reading-room\/whitepapers\/legal\/legal-considerations-creating-incident-response-plan-37487\" rel=\"nofollow\">Legal Considerations of InfoSec Response<\/a><\/li>\n   <li><a href=\"https:\/\/www.experian.com\/\" rel=\"nofollow noopener\" target=\"_blank\">Experian<\/a> - <a href=\"https:\/\/www.experian.com\/assets\/data-breach\/brochures\/response-guide.pdf\" rel=\"nofollow\">Data Breach Response Guide<\/a><\/li>\n   <li><a href=\"https:\/\/digitalguardian.com\" rel=\"nofollow noopener\" target=\"_blank\">DigitalGuardian<\/a> - <a href=\"https:\/\/digitalguardian.com\/blog\/building-your-incident-response-team-key-roles-and-responsibilities\" rel=\"nofollow\">Building Your Incident Response Team<\/a><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"related-checklists\">\n <h2>Related checklists:<\/h2>\n <div class=\"text-content\">\n  <ul>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/inventory-management-process\/\" rel=\"nofollow noopener\" target=\"_blank\">Inventory Management Process<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/network-security-management\/\" rel=\"nofollow noopener\" target=\"_blank\">Network Security Management<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/client-data-backup-best-practices\/\" rel=\"nofollow noopener\" target=\"_blank\">Client Data Backup Best Practices<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/computer-maintenance-guide\/\" rel=\"nofollow noopener\" target=\"_blank\">Computer Maintenance Guide<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/ubuntu-server-setup-process\/\" rel=\"nofollow noopener\" target=\"_blank\">Server Setup Process<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/virtual-private-server-setup\/\" rel=\"nofollow noopener\" target=\"_blank\">Virtual Private Server Setup<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/it-support-process\/\" rel=\"nofollow noopener\" target=\"_blank\">IT Support Process<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/helpdesk-management\/\" rel=\"nofollow noopener\" target=\"_blank\">Helpdesk Management<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/server-maintenance-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Server Maintenance Checklist<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/server-security-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Server Security Checklist<\/a><\/li>\n   <li><a href=\"https:\/\/www.process.st\/checklist\/sql-server-audit-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">SQL Server Audit Checklist<\/a><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Introduction: The worst has happened and the apocalypse is here! Your security's been breached and it's time to spring into action to do some damage control. \"The number of security breaches has increased, the scale and cost has nearly doubled. Eleven percent of respondents changed the nature of their business as a result of their [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":2226,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"\ud83d\udda5\ufe0f","cover_icon_url":"","tasks_count":"27","template_description":"Respond to an information security incident quickly and efficiently.","template_id":"pv2jUncyYfPEbAAd3_dJdg","task_0":"Introduction:","task_slug_0":"introduction","task_1":"Initial response:","task_slug_1":"initial-response","task_2":"Input personnel details","task_slug_2":"input-personnel-details","task_3":"Perform preliminary incident analysis","task_slug_3":"perform-preliminary-incident-analysis","task_4":"Alert response team of incident","task_slug_4":"alert-response-team-of-incident","task_5":"Identify legal obligations","task_slug_5":"identify-legal-obligations","task_6":"Determine who needs to be notified","task_slug_6":"determine-who-needs-to-be-notified","task_7":"Damage control:","task_slug_7":"damage-control","task_8":"Secure the premises around the affected area","task_slug_8":"secure-the-premises-around-the-affected-area","task_9":"Scan for compromised machines","task_slug_9":"scan-for-compromised-machines","task_10":"Disconnect compromised systems from network","task_slug_10":"disconnect-compromised-systems-from-network","task_11":"Backup all critical systems data","task_slug_11":"backup-all-critical-systems-data","task_12":"Preserve all system and application logs and states","task_slug_12":"preserve-all-system-and-application-logs-and-states","task_13":"Enact web server safeguard protocol","task_slug_13":"enact-web-server-safeguard-protocol","task_14":"Monitor the system for signs of continued access","task_slug_14":"monitor-the-system-for-signs-of-continued-access","task_15":"Check IP address reputation score","task_slug_15":"check-ip-address-reputation-score","task_16":"Incident investigation:","task_slug_16":"incident-investigation","task_17":"Determine whether incident has been resolved","task_slug_17":"determine-whether-incident-has-been-resolved","task_18":"Determine the impact of the incident","task_slug_18":"determine-the-impact-of-the-incident","task_19":"Provide suggestion for customer's best course of action","task_slug_19":"provide-suggestion-for-customers-best-course-of-action","task_20":"Communications:","task_slug_20":"communications","task_21":"Alert law enforcement of the incident","task_slug_21":"alert-law-enforcement-of-the-incident","task_22":"Enact federal data breach notification procedure","task_slug_22":"enact-federal-data-breach-notification-procedure","task_23":"Inform upper management of the incident","task_slug_23":"inform-upper-management-of-the-incident","task_24":"Inform the customer of leaked sensitive information","task_slug_24":"inform-the-customer-of-leaked-sensitive-information","task_25":"Sources:","task_slug_25":"sources","task_26":"Related checklists:","task_slug_26":"related-checklists","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[7,16],"tags":[],"class_list":["post-2225","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-miscellaneous","category-quality-assurance"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/2225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=2225"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/2225\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media\/2226"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=2225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=2225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=2225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}