Information Protection Center: Stage 1 - Active: Detection Phase
It is often difficult to determine if the unusual or suspicious event is symptomatic of an incident because apparent evidence of security incidents often indicates a problem with system configuration, untested application program, hardware failure, or frequently user errors. Read the Article
Information Protection Center: Stage 1 - Active: Response Phase
This may involve working with the affected organization to determine the cause of the incident and help them to become secure again, or it may involve finding a solution to a vulnerability that is actively being exploited to compromise many organizational assets. Reactive response is always done on a priority basis and involves three stages--containment, eradication and recovery-- followed by a post-incident analysis. Whatever is done must be consistent with security policies. Read the Article
CIRT - Framework and Models
In this paper I will be discussing significance of CIRT, high level framework of CIRT and describe two standards for forming a CIRT. Comparing two standards could be a topic for a PhD research. Read the Article
