+O-IM-B Stream B: Incident Response
---+O-IM-1-B Create an incident response plan
---+O-IM-2-B Define an incident response process
---+O-IM-3-B Establish an incident response team

O-IM-B Stream B: Incident Response

Incident Response starts the moment you acknowledge and verify the existence of a security incident. Your goal is to act in a coordinated and efficient way so that further damage is limited as much as possible. The activities in this stream focus on the organization's ability to respond appropriately and effectively to reported security incidents.

1. Resumen

O-IM-1-B Create an incident response plan

Maturity level 1 objective of the practice: Best-effort incident detection and handling

Benefit: Ability to efficiently solve most common security incidents

Short description: Identify roles and responsibilities for incident response.

The first step is to recognize the incident response competence as such, and define a responsible owner. Provide them the time and resources they need to keep up with current state of incident handling best practices and forensic tooling.

At this level of maturity, you may not have established a dedicated incident response team, but you have defined the participants of the process (usually different roles). Assign a single point of contact for the process, known to all relevant stakeholders. Ensure that the point of contact knows how to reach each participant, and define on-call responsibilities for those who have them.

When security incidents happen, document all actions taken. Protect this information from unauthorized access.
O-IM-2-B Define an incident response process

Maturity level 2 objective of the practice: Formal incident management process in place

Benefit: Understanding and efficient handling of most security incidents

Short description: Establish a formal incident response process and ensure staff are properly trained in performing their roles.

Establish and document the formal security incident response process. Ensure documentation includes information like:

  • most probable or common scenarios of security incidents and high-level instructions for handling them; for such scenarios, also use public knowledge about possibly relevant third-party incidents
  • rules for triaging each incident
  • rules for involvement of different stakeholders including senior management, Public Relations, Legal, privacy, Human Resources, external (law enforcement) authorities, and customers; specify mandatory timeframe to do so, if needed
  • the process for performing root-cause analysis and documentation of its results

Ensure a knowledgeable and properly trained incident response team is available both during and outside of business hours. Define timelines for action and a war room. Keep hardware and software tools up to date and ready for use anytime.
O-IM-3-B Establish an incident response team

Maturity level 3 objective of the practice: Mature incident management

Benefit: Efficient incident response independent of time, location, or type of incident

Short description: Employ a dedicated, well-trained incident response team.

Establish a dedicated incident response team, continuously available and responsible for continuous process improvement with the help of regular RCAs. For distributed organizations, define and document logistics rules for all relevant locations if sensible.

Document detailed incident response procedures and keep them up to date. Automate procedures where appropriate. Keep all resources necessary for these procedures (e.g., separate communicating infrastructure or reliable external location) ready to use. Detect and correct unavailability of these resources in a timely manner.

Carry out incident and emergency exercises regularly. Use the results for process improvement.

Define, gather, evaluate, and act upon metrics on the incident response process, including its continuous improvement.

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.