Assessment Objective
Determine if:
- IR-04(12)[01] malicious code remaining in the system is analyzed after the incident;
- IR-04(12)[02] other residual artifacts remaining in the system (if any) are analyzed after the incident.
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident handling
- procedures addressing code and forensic analysis
- procedures addressing incident response
- incident response plan
- system design documentation
- malicious code protection mechanisms, tools, and techniques
- results from malicious code analyses
- system security plan
- system audit records
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- organizational personnel installing, configuring, and/or maintaining the system
- organizational personnel with responsibility for malicious code protection
- organizational personnel responsible for incident response/management
Test
- Organizational process for incident response
- organizational processes for conducting forensic analysis
- tools and techniques for analysis of malicious code characteristics and behavior
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | IR-04(12) Malicious Code and Forensic Analysis |