课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

免费学习该课程！

今天就开通帐号，24,600 门业界名师课程任您挑！

Post-incident activities

Post-incident activities

课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

开始一个月试用 购买团队方案

Post-incident activities

“

- [Instructor] Once the incident response team returns the organization to a normal operating state, avoid the temptation to end the response effort without completing an important final step. Post-incident activities. Let's talk about three important post-incident activities. The lessons learned process, evidence retention, and the generation of indicators of compromise. The lessons learned process is designed to provide everyone involved in the incident response effort an opportunity to reflect on their individual role in the incident, and the team's response overall. The lessons learned process provides an opportunity to improve the processes and technologies used in incident response to better respond to future security crises. And the most common way to conduct a lessons learned session is to gather everyone in the same room or connect them by video conference or telephone, and ask a trained facilitator to lead a lessons learned session. Ideally, this facilitator should have…

内容