How do you plan and execute recovery and restoration activities for different systems and services?

由人工智能和领英社区提供技术支持

When you face a cyber incident, your main goal is to contain the threat, minimize the damage, and restore normal operations as soon as possible. But how do you plan and execute recovery and restoration activities for different systems and services? In this article, we will cover some key steps and best practices for incident handling and recovery.

此文章中的业界达人

由社区从 1 条内容中精选。了解更多

David Ryan Hawley - CISSP

SIEM/SOC Engineer, Tier IV SOC Analyst, DevSecOps Cloud Architect, linkedIn Board Advisories

1 Assess the impact

The first step is to assess the impact of the incident on your systems and services. You need to identify which assets are affected, how severe the damage is, and what are the potential risks and consequences. You can use various tools and methods to collect and analyze evidence, such as logs, backups, network traffic, malware analysis, and forensic tools. You should also communicate with your stakeholders, such as customers, partners, regulators, and media, and inform them about the incident status and the recovery plan.

添加您的观点

David Ryan Hawley - CISSP

SIEM/SOC Engineer, Tier IV SOC Analyst, DevSecOps Cloud Architect, linkedIn Board Advisories
举报内容
The BEST way to access the impact (damage/vulnerabilities) is by using a SIEM/SOAR. This is why I architected an AI SIEM in 2003, prior to this nobody had time to read all the logs of millions of devices on the Enterprise and correlate them manually. special purpose SIEMs like QRadar Network Insights search for patterns, QFlow, JFlow. Pouring your efforts into the SIEM is way more effective. Backups are critical, but GIGO if they store malware, infected systems, they are no good. DLT tape or compressed archives stored on SAN or NAS or other high quality media. Scan Kube Containers. Communicating to the Incident Manager so they can communicate to C level. Follow all the steps covered in SANS GIAC GCIH, no space to cover them here.

已翻译

赞

2 Define the recovery objectives

The next step is to define the recovery objectives and priorities for your systems and services. You need to determine what are the minimum acceptable levels of functionality, performance, and security that you need to resume normal operations. You also need to estimate how long it will take to achieve those levels, and what are the resources and costs involved. You should align your recovery objectives with your business goals and your incident response policy.

添加您的观点

3 Implement the recovery plan

The third step is to implement the recovery plan and execute the recovery actions. This process should be systematic and documented, and should include tasks such as isolating and removing compromised or infected systems, restoring them from clean backups or rebuilding them from scratch, applying the latest patches and updates, testing and verifying functionality, performance, and security of the systems and services, monitoring and auditing for any signs of recurrence or residual issues, and documenting the recovery actions and outcomes.

添加您的观点

4 Evaluate the recovery results

The final step is to evaluate the recovery results and measure the effectiveness of your recovery plan. You need to compare the actual recovery levels with the expected recovery objectives, and identify any gaps or deviations. You also need to assess the impact of the incident and the recovery on your business operations, reputation, and compliance. You should collect feedback from your stakeholders, such as customers, partners, regulators, and media, and address any issues or concerns. You should also document the lessons learned and the recommendations for improvement.

添加您的观点

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Incident Handling

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you plan and execute recovery and restoration activities for different systems and services?

1

2

3

4

5

1 Assess the impact

2 Define the recovery objectives

3 Implement the recovery plan

4 Evaluate the recovery results

5 Here’s what else to consider

Incident Handling

给文章评分

感谢您的反馈

更多Incident Handling相关文章

更多相关阅读内容