Leighton Johnson - Computer Incident Response and Forensics Team Management: Conducting a Successful Incident Response

Incident response framework

When I started as the corporate Computer Security Manager for a large retail organization 15 years ago, there was no response team, no computer security awareness among the IT staff or senior management, and no driving need to implement any security activities, structures, or requirements for the corporate workers. Everyone from the CEO down thought the computer security situation was someone elses problem and concernthe classic not my problem syndrome.

The first task I embarked on as the Computer Security Manager was to educate the senior executives in the need for corporate computer security and the ability to respond to potential threats to the work environment. It took almost a year, but the corporate leadership did finally accept and fund the development of an incident response capability which was that industrys first team specifically designed to handle and manage incidents which affected the day-to-day operations of the organization and its bottom line.

Security Incident Response and Forensics Response Teams (SIR&FT) are needed more today than ever before during the Computer and Internet Era which has developed over the last 40 years. Today, with most security response organizations and vendors reporting an incredible 30,00070,000 pieces of new malware being introduced each day, the need for responders and investigators is at an all-time high. Every major corporation, all governmental agencies, and most organizations operating on the Internet, using e-mail, or transacting business online require the ability to respond to an unexpected or malicious attack on their networks and infrastructure just to stay in business, let alone perform their daily tasks safely and securely.

All incidents threaten the business or government organization as a whole. The organizations primary business process, all its other processes and reputationthey are all in jeopardy when these incidents strike. Security incident response and management seek to prevent such incidents from happening. And when they inevitably happen, to contain and resolve them, and use the response lessons learned for the next time. Therefore, security incident response and management serve both the primary response process and the organization as a whole.

Since the proliferation of malware is rampant today where the adversary eventually breaches some aspect of a corporations protective measures, along with the high impact of insider threat issues as evidence by recent Corporate, Intelligence and Defense incidents, the primary focus for the SIR&FT is simple but profound:

1. detect compromise as efficiently as possible;

2. respond to incidents as quickly as possible; and

3. investigate using digital forensics as effectively as possible.

The Incident Response team will become one of your most important development activities as the manager in the first days as you start up the management and oversight of the security incident response team (SIRT) and the Forensics investigation team. The team member makeup, the team charter, the corporate executive officer support, the response criteria, all make the SIRT one of the more important team-building activities you will be responsible for at the start.