-: Security Incidents.
So the big thing to remember here
is that you're gonna have to conduct
an incident response one day.
It's just a matter of fact,
if you're gonna be running a network
because cyber incidents are going to happen.
No matter what your organization does
to prevent a cyber incident,
eventually someone is gonna hack you,
someone's gonna attack you,
and they're gonna get in.
So, the question is,
how are you gonna respond?
How are you gonna react?
How are you gonna recover?
Well, having a good incident response plan
will help answer these questions and many more.
So, you will have to plan your incident response
because it's going to happen.
You have to plan this in advance
to make sure that your response is effective
and quick in responding to the issue.
You always are gonna have a coordinated
and methodical response because
this takes the fear out of it
and it takes the anxiety out of it.
If you have prior planning
it's gonna minimize the damage that's gonna occur
and decrease your response time.
Thereby, making you more effective,
efficient, and get you back on
the road to recovery that much quicker.
This is the reason why it's important to have
an effective incident response plan.
Security events and incidents.
So we've talked in the last lesson about
there's a difference between an event
and an incident.
Well, here's three definitions that you
have to understand if you're gonna take
the CSA plus exam,
as well as just operating in the real world
in the incident response realm.
An event.
An event is an observable occurrence
on a system or network.
Now, an event doesn't necessarily mean
it's a bad thing, it's just something that happens.
When you log on to your computer
there's an event that's created
called the log on event.
Now, if you try to log on the computer
with the wrong password,
you're also gonna create an event
called the log in error event, right?
So there's two different types of events.
There's good ones and there's bad ones.
Now, when we talk about bad ones
we're talking about adverse events.
These are any events that have negative consequences
such as somebody logging into your network
and breaking in, that would be an event.
Somebody running a malicious piece of software,
thhat's an event.
Now, when does this become an incident?
Well, an incident is something that has
an imminent threat of violation
or a violation itself of your security policy,
your acceptable use policies,
or any standard security practice.
So, let me give you an example.
If you're at work
and your buddy gets your username
and password and logs in as you,
is that an incident?
Well, if your security policy
or your acceptable use policy
says that only the person who has been given
the username and password can log in,
which, by the way, that should be in your policy,
then, yes, this was an incident.
Somebody logged in pretending to be
somebody else.
Now, is this a really bad, malicious incident?
Well, maybe or maybe not.
It depends on what your buddy's intent was,
but it is an incident, nonetheless.
Now, let's take it a step further.
Let's say that, instead somebody
from outside the organization
sent us a phishing email into your organization.
Somebody clicked the link,
and a piece of malware was downloaded and executed.
Is that an incident?
Well, of course, because it goes against
your security policy.
There's malicious software running
on your network,
and that, may in fact, trigger
an incident response which will bring up
your incident response plan.
Now, not every event is incident,
but every incident does contain at least
one event, and sometimes it's multiple events.
A lot of times, you'll see these things,
and it's our jobs as analysts
to piece them together.
We'll see five or six or seven different events
that, each on their own,
may not be a big deal,
but when you put them all together,
it becomes an indication of a
bigger cyber incident that's occurring
then we then have to respond to.
Now, who's the people who are gonna
respond to these events?
Well, that's your computer's
security incident response team,
or your CSIRT.
Now, this is a team of professionals
who are responsible for handling security
incidents within the organization
using standardized practices and procedures.
Now, who's on this team?
Well, we're gonna get into that
in the next lecture.