Incident response procedures

There are many different incidents, and each of them requires a different incident response plan. For example, dealing with a flood or the failure of a server's hardware is totally different. The first stage of an incident response plan is to collect any volatile evidence so that the source of that incident can be identified, followed by containment of the incident itself, followed by the recovery procedures. Let's look in more detail at the components required to make incident response successful:

• Documented incident types: We should already have documentation about each incident that shows the steps required for a positive response. These types of incidents are laid down under different category definitions.
• Category definitions: Your company should have an outline plan for dealing with most incidents ranging from the following categories:
  • Unauthorized access
  • Loss of computers or data
  • Loss of availability
  • Malware attack
  • DDoS attack
  • Power failure
  • Natural disasters such...