- [Instructor] When security professionals detect
a potential incident,
they should immediately swing into first responder mode,
acting to isolate affected systems
and contain the damage caused by the incident.
As soon as they've handled the immediate emergency,
they should move into the incident escalation
and notification process.
The escalation and notification process
has several important objectives.
First, it evaluates the severity of the incident
based upon the incident's potential impact
on the organization's security.
Second, it escalates the incident to an appropriate level
of incident response.
Finally, it notifies management and other stakeholders
of the incident and plans to resolve it.
After containing an incident,
responders should begin a triaging process
that identifies the potential impact of the incident.
The process for rating incident severity should be found
in the organization's incident response procedures.
One common scheme uses a three-tiered scale
of low-impact, moderate-impact, and high-impact incidents.
Low-impact incidents have minimal or no potential
to affect the confidentiality, integrity,
or availability of the information or systems belonging
to the organization.
In low-impact incidents,
first responders would normally attempt
to resolve the incident themselves
and wait to call in additional resources
or perform notification until the incident escalates
or is resolved.
Low-impact incidents would not normally call
for an after-hours response.
Moderate-impact incidents are more likely
to have a significant impact
on the organization's security posture.
The occurrence of a moderate-level incident
normally triggers the full or partial activation
of the incident response team
and prompts notification of management.
High-impact incidents may cause critical damage
to an organization and justify an immediate, full response.
Senior executives should be immediately notified
and the entire incident response team should be mobilized.
Members not needed for the immediate response
should be informed that an incident response is underway
and placed on standby status.
The notification and escalation process will vary
from organization to organization,
but the common theme is
that this process must be clearly thought out
and have appropriate tools in place.
At a minimum, first responders should have access
to the mobile phone numbers of anyone who may need
to be notified.
Organizations may choose
to put in place a technology solution
that automates the team response.