Advanced Persistent Threat by Eric Cole

Author:Eric Cole
Language: eng
Format: epub, pdf
ISBN: 9781597499552
Publisher: Elsevier Inc.
Published: 2013-01-27T16:00:00+00:00

There is a lot of focus, energy and effort put against incident response today, but what we have found is not everyone is using the same definitions. Therefore in order to make sure that we are using consistent terminology, the following terms will be used throughout this section:

• Event—An observable occurrence or activity that is being performed. The easiest way to think of an event is an entry in a log file. Logs typically store events and become the key evidence in proving what has happened on a system. This is the reason why protection and control of the log files is so important is because they contain the events.

• Incident—An adverse event resulting in harm or the threat of an adverse event that could cause potential harm to computer systems or data. Anything that impacts or could impact a system falls under an incident. It is important to remember that intent does not matter. Both an APT breaking into a system and a pipe breaking and flooding your data center would be considered an incident.

• Incident Response (IR)—Actions taken subsequent to an incident to understand the incident and take remedial action. The key theme of security is prevention is ideal but detection is a must. Incident response focuses in on once an attack is detected, assessing the damage, responding and recovering back to normal operation. If normal operations are interrupted when an incident occurs, IR focuses on recovery and getting the organization back up and running.

• Computer Forensics—The science of analyzing, finding, and presenting digital evidence in court. One of the key steps of incident response is to figure out what happened. Discovering evidence is critical to determining what happening and for making a case in court to prove your side in order to get a favorable ruling. Forensics focuses in on making sure you have the information you need to determine and prove what happened.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.