Assume there is an incident that requires immediate response, such as a virus outbreak over email, Cryptolocker actively encrypting files, or a DOS attack.
How should I approach this in a way that would not only be valued in terms of our customers (SLA, etc), but also be positively viewed by all levels of management and my peers?
I suppose there are the following phases:
Sometimes an incident requires us to go backwards and re-identify the issue, (e.g. it's not a web server issue, it's a DOS attack), and often a well-intended technician will work on tasks that overlap and may not help the situation, or worse, they may impede other issues. (e.g. a SAN restore on the same LUN as production, killing performance)
Since there are often many moving parts to solving the issues, what process can I look at for guidance to give the containment and remediation process more structure?
Some things I can think of include:
- Identify affected users, business stakeholders
- Identify people, vendors that are working on the solution
- Communicate tasks, and status of all tasks between people and vendors working on the solution
- Share audience appropriate status (helpdesk, management, executive)
There should be some kind of guidance that has already written that addresses this, e.g. in a "runbook" of sorts, but I'm not sure what it would be called. Search terms would be appreciated