- [Instructor] Once you have
an incident response plan in place and a team prepared,
the incident response process
then enters a state of perpetual monitoring,
watching for signs that an incident is taking place
or has already occurred.
There are many different ways that an organization
might identify a security incident.
The key to successful incident identification
is having a robust security monitoring infrastructure.
Data is crucial to incident detection
and organizations have a responsibility to collect,
analyze, and retain security information.
There are many different information sources
that may contribute data crucial to identifying
and analyzing a possible security incident.
These include intrusion detection and prevent systems,
firewalls, authentication systems,
system integrity monitors, vulnerability scanners,
system event logs, NetFlow connection records,
and anti-malware packages, among many other sources.
If IT systems do one thing well,
it's generating massive amounts of log information.
Security professionals are responsible for collecting
and correlating this information.
Unassisted, that's almost an impossible undertaking.
Fortunately Security Incident and Event Management,
or SIEM technology, can assist with this task.
SIEM systems act as centralized log repositories
and analysis solutions.
Security professionals can take the fire hose of data
they receive from security related logs
and point them at the SIEM,
which can do the heavy lifting and analysis work.
SIEM systems may detect possible incidents
based upon rules and algorithms,
bringing them to the attention of security administrators
for further review.
They also provide a critical centralized information source
to investigators pursuing a security incident.
We've just talked about many of the ways
that a security team might identify incidents
based upon internally generated data.
And in the best case that's the way we detect incidents,
by noticing the signs of incident as it occurs
or shortly thereafter.
Unfortunately sometimes those monitoring systems
fail to detect an incident
and we first learn of security compromise
by hearing from employees, customers,
or external organizations who see the signs of a breach.
This might occur when a customer sees his or her
personal information posted on the web,
when a system on the corporate network
begins attacking an external site
due to commands received from a botnet,
or when an employee notices that he or she
can't login to an email account.
The incident response team should have a consistent method
for receiving, recording, and evaluating
these external reports.
When a security professional identifies a potential incident
it's time to swing into incident response mode.
We'll talk more about the full incident response process
in the next few videos,
but there is an important first step.
The team member who first notices an incident
and others who may be on duty,
have special first responder responsibilities.
Just as an in a medical emergency,
the first person on the scene has the ability to have
a tremendous impact on a successful response
to an incident, like acting quickly
and decisively to protect the organization.
First responders should act quickly to contain the damage
from a security incident.
If they suspect that a system
or a group of systems maybe compromised,
the first responders should immediately isolate
that system from the rest of the network
to contain the damage.
Depending upon the technical circumstances,
first responders may quarantine the system
by removing it from the network,
keeping it running to preserve evidence,
but cutting off the potentially compromised system's ability
to communicate with attackers
or infect other systems on the corporate network,
effectively quarantining it.
This is a favorite topic for exam questions.
Remember, a first responder's highest priority
should be containing the damage
by isolating effected systems.