Incident response

Abstract

A typical networked operation will observe anywhere from hundreds to thousands of improper or at least suspicious events happening to and with its network on a daily basis. Maximal reaction to each and every one of these events is most often impossible, certainly very costly, and frequently a waste of time. This writing will show that the appropriate actions to be taken in response to improper or suspicious events should be based on security policy and risk analysis in all organizations. Further, it will show that the theoretically ideal responses must be adjusted to take into consideration individual conditions within specific organizations.