University:
Western Governors University
Course:
C844 | Emerging Technologies in Cyber Security
Academic year:

2023
Views:

45

Pages:

1
Author:

Hallie Randolph

Cybersecurity and Infrastructure Security Agency (CISA) Incident Response Playbook CISA's incident playbook provides a standardized response process for cybersecurity incidents. The playbook follows specific goals according to the incident response phases defined in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Rev. 2,5 and Johansen (2017), including preparation, detection and analysis, containment, eradication and recovery, and post-incident activities: 1. Prepare for severe incidents before they happen to minimize the impact on the business by ensuring resilient architectures and systems to maintain vital operations in a compromised condition. 2. Work with affected agencies in all stages of the detection and analysis process to ensure processes are in place to deconflict possible events with permitted activities. 3. Remove adversary access to prevent further damage and lessen the immediate impact of the incident. Specific scenarios will determine the type of containment strategy used. 4. Restore normal operations by removing incident artifacts and mitigating vulnerabilities or other exploited conditions. 5. Document incidents, inform agency leadership, harden the environment to prevent similar incidents, and apply lessons learned to improve incident handling in the future. These phases are guidelines dedicated to Federal Civilian Executive Branch (FCEB) Agencies to follow for a confirmed malicious cyber activity. Although, the playbook does not cover response activities that involve threats to classified information or National Security Systems (NSS). Despite its limitations, the strength of this playbook is coordination across multiple agencies. Collaboration across all federal government organizations has proven to be an effective model for dealing with vulnerabilities and incidents. As a result of CISA's connection, its incident response playbook has the resources that will allow organizations to: ● Rapidly notify relevant critical infrastructure stakeholders of elevated risk exposure. ● Conduct incident management operations. ● Provide vulnerability assessments. ● Directly deploy risk management information, tools, and technical services to mitigate risk, including regulatory enforcement. Overall, CISA's playbook aims to learn from previous incidents and incorporate industry best practices to help affected organizations better coordinate and respond to incidents, track cross-organizational successful actions, catalog incidents to manage future events better, and guide analysis and discovery. Agencies should use this playbook to help shape overall defensive cyber operations to ensure consistent and effective response and coordinated communication of response activities. Furthermore, future iterations of these playbooks may help standardize incident response practices for organizations outside of the FCEB.

New Documents from this Course

Role-Based Access Control (RBAC) Matrix

Western Governors University C844 | Emerging Technologies in Cyber Security

Study Guide

Description

Related Documents

Almost There!

Free up your schedule!

Take 5 seconds to unlock