Incident Response: A Strategic Guide to Handling System and Network Security Breaches

Incident Response: A Strategic Guide to Handling System and Network Security Breaches

by Dr. Eugene E. Schultz, Russell Shumway
Released November 2001
Publisher(s): Sams
ISBN: 1578702569

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

This book teaches readers what they need to know to not only set up an incident response effort, but also how to improve existing incident response efforts. The book provides a comprehensive approach to incident response, covering everything necessary to deal with all phases of incident response effectively ¿ spanning from pre-incident conditions and considerations to the end of an incident.

Although technical considerations, (e.g. the particular binaries in Unix and Linux and dynamically linked libraries in Windows NT and Windows 2000) that need to be inspected in case they are corrupted, the types of logging data available in major operating systems and how to interpret it to obtain information about incidents, how network attacks can be detected on the basis of information contained in packets, and so on ¿ the major focus of this book is on managerial and procedural matters. Incident Response advances the notion that without effective management, incident response cannot succeed.

Table of contents

  1. Copyright
  2. About the Authors
  3. About the Technical Reviewers
  4. Acknowledgments
  5. Tell Us What You Think
  6. Introduction
  7. An Introduction to Incident Response
    1. What Is Incident Response?
    2. The Rationale for Incident Response
    3. Overview of Incident Response
    4. Summary
  8. Risk Analysis
    1. About Risk Analysis
    2. Types of Security-Related Risks
    3. Obtaining Data About Security-Related Incidents
    4. The Importance of Risk Analysis in Incident Response
    5. Summary
  9. A Methodology for Incident Response
    1. Rationale for Using an Incident Response Methodology
    2. A Six-Stage Methodology for Incident Response
    3. Caveats
    4. Summary
  10. Forming and Managing an Incident Response Team
    1. What Is an Incident Response Team?
    2. Why Form an Incident Response Team?
    3. Issues in Forming a Response Team
    4. About Managing an Incident Response Effort
    5. Summary
  11. Organizing for Incident Response
    1. Virtual Teams—Ensuring Availability
    2. Training the Team
    3. Testing the Team
    4. Barriers to Success
    5. External Coordination
    6. Managing Incidents
    7. Summary
  12. Tracing Network Attacks
    1. What Does Tracing Network Attacks Mean?
    2. Putting Attack Tracing in Context
    3. Tracing Methods
    4. Next Steps
    5. Constructing an “Attack Path”
    6. Final Caveats
    7. Summary
  13. Legal Issues
    1. U.S. Computer Crime Statutes
    2. International Statutes
    3. Search, Seizure, and Monitoring
    4. Policies
    5. Liability
    6. To Prosecute or Not?
    7. Conclusion
  14. Forensics I
    1. Guiding Principles
    2. Forensics Hardware
    3. Forensics Software
    4. Acquiring Evidence
    5. Examination of the Evidence
    6. Conclusions
  15. Forensics II
    1. Covert Searches
    2. Advanced Searches
    3. Encryption
    4. Home Use Systems
    5. UNIX and Server Forensics
    6. Conclusions
  16. Responding to Insider Attacks
    1. Types of Insiders
    2. Types of Attacks
    3. Preparing for Insider Attacks
    4. Detecting Insider Attacks
    5. Responding to Insider Attacks
    6. Special Considerations
    7. Special Situations
    8. Legal Issues
    9. Conclusion
  17. The Human Side of Incident Response
    1. Integration of the Social Sciences into Incident Response
    2. Part I: Cybercrime Profiling
    3. Part II: Insider Attacks
    4. Part III: Incident Victims
    5. Part IV: Human Side of Incident Response
    6. Summary
  18. Traps and Deceptive Measures
    1. About Traps and Deceptive Measures
    2. Advantages and Limitations of Traps and Deceptive Measures
    3. Focus: Honeypots
    4. Integrating Traps and Deceptive Measures into Incident Response
    5. Summary
  19. Future Directions in Incident Response
    1. Technical Advances
    2. Social Advances
    3. The Progress of the Profession
    4. The Nature of Incidents
    5. Conclusion
  20. RFC-2196
    1. Site Security Handbook
  21. Incident Response and Reporting Checklist

Product information

  • Title: Incident Response: A Strategic Guide to Handling System and Network Security Breaches
  • Author(s): Dr. Eugene E. Schultz, Russell Shumway
  • Release date: November 2001
  • Publisher(s): Sams
  • ISBN: 1578702569