Windows Server 2003 Security: A Technical Reference

Introduction to Incident Response

Incident response is the collection of actions taken after an alleged security incident is identified. In many organizations, a formal incident response team coordinates response. Its members are drawn from IT, audit, security, human resources, legal, senior management, and other areas of the company. In many cases, only a few of these people are assigned to any incident, and additional employees as well as outside specialists may be recruited during specific incidents. In other companies, incident response is less formal. Teaching you how to create a crack team and detailing how to respond to every possible security incident is not the purpose of this section. Instead, its purpose is to help you identify action ...