Guidance on Incident Handling and Incident Response

last modified 2008-04-16 20:08

Reference documents and "how-tos" for computer incident response and incident handling.

Responding to IT Security Incidents Good general guidance
What to Do When Your Security's Breached Emergency guidance for the not-yet-prepared
Incident Response: Managing Security at Microsoft More specific advice for several different types of incidents
Basic Steps in Forensic Analysis of Unix Systems Introductory article on forensic analysis
If I suspect a system is compromised what should I do? One page summary
Writing an Incident Handling and Recovery Plan A general incident response plan in outline format
Responding to Intrusions is provided by the CERT Coordination Center, along with security alert information and other timely advice.
The Intrusion Discovery Cheat Sheets from the SANS Institute offer guidance for unearthing evidence of security breaches in a handy format. There is one for Windows and one for Linux
Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition Covers seizure of electronic devices at a crime scene. Written primarily for law enforcement, yet offers general guidance for acquisition and preservation of electronic evidence
Best Practices for Seizing Electronic Evidence Standard procedures for taking charge of electronic evidence. Written primarily for law enforcement, yet useful to systems administrators
Incident Handling and Response The EDUCAUSE module on incident response.
Computer Security Incident Handling Guide The heavy duty NIST incident response manual. A copy has been downloaded here.

RUSecure