Professional Documents
Culture Documents
Virus Outbreak
Virus Outbreak
COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
-1-
PRESENTED BY
To learn more about playbooks and incident response, visit IncidentResponse.com
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
What is an incident response playbook? According to NIST Special Publication 800-61, an incident response process contains four main phases: preparation,
detection and analysis, containment/eradication/reocvery, and post-incident activity. Descriptions for each are included below:
Virus Outbreak
You’ve selected the “Virus Outbreak” playbook. On the pages that follow, you will find your incident response
playbook details broken down by the NIST incident handling categories.
-2-
PRESENTED BY
To learn more about playbooks and incident response, visit IncidentResponse.com
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
P R E PA R E - V I R U S O U T B R E A K
Define
Escalation Path
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
DETECT - VIRUS OUTBREAK
Prev
Step
Define
Standard Threat Custom Custom Indicators
Indicators
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
A N A LY Z E - V I R U S O U T B R E A K
Prev
Step
Internal user PII or other External user PII or PII or other protected
protected information other protected information has been
at risk of being exposed information at risk of compromised
being exposed
Ability to control /
record/measure/track This act is being There is internal
any significant amounts launched by known knowledge of this
of inventory/products / entities incident
cash/revenue is lost
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
C O N TA I N - V I R U S O U T B R E A K
Identify additional
system(s) that are at risk
of being compromised
Vulnerability System
Identify any source Select Database Query Database Generate Report
attribution collected Logs Logs
Identify how
widespread the attack
View Report View Record Details Select Records Copy Record Details
has spread
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
E R A D I C AT E - V I R U S O U T B R E A K
Prev
Step
In-Person Intranet
Meeting Meeting
Communications
Mobile Internet
Messaging Meeting
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
RECOVER - VIRUS OUTBREAK
Prev
Step
Remove
Recover Systems Reimage Rebuild Temporary
Containment
Next
Step
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
POST-INCIDENT - VIRUS OUTBREAK
Prev
Step
Response Workflow
Updated
INCIDENTRESPONSE.COM
INCIDENTRESPONSE.COM
ON L I N E I N C I D E N T R E S P ON S E CO M M U N I T Y
Effective Remediation
Organization and automation are key benefits that result in effective remediation. Automated playbooks help to Risk Management Benefits
organize security processes, mitigation plans and smooth communication between multiple departments. By • Communicate effectively to ensure risk
optimizing data collection, analysis, and communications you improve the odds for effective eradication, recovery mitigation methods are applied
with integrity and forensic-quality reporting. • Prioritize resources and activities where
they matter most
• Report and tune based on response
Action Plan learning, reducing risk moving forward
Having a view into what is possible is the first step in taking action. The next step is to bring your team together to
drive it toward reality. Email this guide to your peers and managers to begin sharing your playbook with them. Useful Links:
NIST Risk Management Framework Guide
With this playbook, you will be better prepared to handle the response. To help with the management and automation
Sample Policies and Plans
of this incident response playbook, consider working with CyberSponse and their partners. Come take a look at what
they do.
- 10 -
PRESENTED BY
To learn more about playbooks and incident response, visit IncidentResponse.com