Here’s the class for this note, the source, and the IBM Data Breach Calculator for fun. This note is in lowercase, as it’s taken directly from my actual school-notes vault in Obsidian!
Similar to the Vulnerability Management Lifecycle, this process has three general phases: prepare, respond, follow-up.
phase 1: preparation
This phase is essentially the e-discovery1 process.
- consider a criticality assessment for your org
- cyber security threat analysis with realistic scenarios and rehearsals
- consider the implications of people, process, technology, & information
- create a control framework
- review your state of readiness
phase 2: detection and analysis
- identify the security incident
- define objectives and investigate
phase 3: containment, eradication, and recovery
- take appropriate action
- recover systems, data, and connectivity
phase 4: post-incident activity
- investigate incident thoroughly
- report incident to relevant stakeholders
- post-incident review
- communicate & build on lessons learned
- conduct root cause analysis and complete a LLR (lessons learned report) or an AAR (after-action report)
- update key information, controls, & processes
- perform trend analysis
-
e-discovery: data inventory, classification, & management
- understand current tech status and how to control data retention & backup