Chapter 26: Planning for Incident Response

Chapter 26

Planning for Incident Response

Even if your network has solid protections in place, a determined attacker might be able to penetrate your defenses if given sufficient time. By understanding the baseline of your network and its normal behavior, monitoring audits and other logs to see activity in real time, and maintaining an inquisitive skepticism, you can build a solid incident response framework.

In this chapter, we will look at incident response as a component of the often used Protect Detect Respond model. The model is iterative: protect against the threats you can, detect those threats you have not prevented against, respond to any threats you detect, improve your processes and defenses based on what you have learned, and then repeat the sequence.