IR Strategy is defined as means and mechanism to bring the systems back to normality by restoring operations after the incident. There are two philosophies:
1) protect and forget and
2) apprehend and prosecute.
Each company will have to determine which philosophy to follow and under what circumstances. The incident commander must first assess the situation after the breach.
The assessment will look at what type of incident occurred, how much information was destroyed or stolen, and how to best tell the public.
The commander will also be responsible to determine how the breach occurred and how to keep this breach from occurring in the future. The incident commander will also confirm the incident and how to escalate the situation if necessary. Incident recovery maintains that all systems must be reestablished to the pre-incident status.
The CSIRT leader must determine the appropriate response based on the variables of the breach type, the method of incursion, the current level of loss, and the sensitivity of the information breached. A containment strategy should be written and include the details of how the organization will handle theft and damage to assets.
Whitman, E., Mattord, H. J., & Green, A. (2017). Principles of Incident Response & Disaster Recovery. Boston, MA: Cengage Learning.
Here are some observations from our Mid-term. Please remember these points when writing your Case Studies. Grades are all posted
Your work must be written in MicroSoft Word. I do not have a MAC and cannot open a file written on a MAC machine.
Simply using a web site does not constitute a reference. See the Getting Started folder on how to create a reference.
You must cite your reference in your paper. Just giving me a reference, but not showing me where you used a reference in the paper by a citation will count off points. Again, see the Getting Started folder on how to reference and cite.
Do not use a translator program. I can tell immediately because the sentences are non-sensical. You must contact the University writing center to receive help.
Remember:
Your paper must be double spaced.
Load all papers into the BOX account. Do not email any papers.