Effective Incident Response Team, The

Chapter 9. What Did That Incident Cost?

Your organization has been the victim of a computer incident, whether it be from malicious or nonmalicious intent. You have successfully identified the problem(s) and helped with the recovery process. Now you're asked what may be the most challenging question: “How much did the incident cost?” How do you respond? If the incident was a denial-of-service attack or major virus infection, do you take the payroll of all affected employees and tally the wages for the period of lost productivity? If it was industrial espionage, do you guess at the value of the information and provide that answer? If it was a compromise, do you total the person-hours and salaries for those involved with the response and provide ...