Steps to Effectively Respond to a Security Incident and Threats on a Wireless Network
Incident response is usually one of those security areas that tend to be impromptucompanies don't think about it until they have to. But that needs to change. In this paper I will discuss five steps - identification, containment, eradication, and recovery and follow up a business use to effectively response to a security threat and I will suggest four actions -use encryption and passwords, e-mail protection, install antivirus software, install workstation firewalls a businesses can take to effectively prevent a security incident in the future.
Businesses today must manage growing risks to their mission critical networks from attacks such as spyware, rogue wireless LANs, compromised remote/VPN users, DDOS attacks, system misconfigurations, and unpatched OS's, all of which increase the risk of a network breach and interruption to both sales and business operations.
Does your business operate a network that has public access? If you monitor that networkyou are monitoring your network, right?then sooner or later, you're going to have a security incident. How you respond to such an incident often decides how long your network will continue to function as a part of your business.
Incident response is usually one of those security areas that tend to be impromptuyou don't think about it until you have to. But that needs to change. Every organization should develop an incident response policy (IRP). Security incidents don't wait for organizations to have their ducks in a row. In fact, they tend to occur at the most inopportune times.
Let's look at five steps businesses can take to effectively respond to a security incident.
First, identify the traffic to determine whether it poses a threat to your network. If your logs (i.e., IDS, firewall, event, etc.) uncover an issue or a user reports a problem, analyze the information to determine whether it's accurate and if it has the potential to disrupt or deny network services. Once you've completed the analysis and determined the information is credible and includes the potential for harm, classify the event as an incidentany adverse event that compromises some aspect of computer or network security.
After you've identified a security incident, the next step is to contain the damage and prevent harm from spreading further throughout the networkor even harming networks outside your security boundary. The most immediate means of containment is either to disconnect the infected machine and isolate it from the network or to stop the service that's causing the incident. Make sure you've documented who has the authority to disconnect systems and possibly disrupt business needs. This need to be in writing, and the designated authority should be available 24/7.
After you've taken steps to contain the incident and its effects, eradication is the next step. Your security...