Cybersecurity Defensive Operations And Countermeasures Paper You are now the Manager of a Security Operations Center (SOC) for Incident Response at a large

Cybersecurity Defensive Operations And Countermeasures Paper You are now the Manager of a Security Operations Center (SOC) for Incident Response at a large corporation. Your first task is to write and plan your Incident Response Plan in detail. Make sure you address the following:

I. Process and Procedures

II. Logistics

III. Planning and Operations

IV. Incident Management

V. Containment Operations

VI. Recovery Operations

**My part is only in the bold text please research about V. Containment Operations

VI. Recovery Operations Thank you Process and Procedures
An appropriate incidence response plan has the following aspects of processes and
procedures addressed. To begin with, the plan will have a clear outline of the steps that will be
followed to ensure that the incident is properly handled. The processes to be implemented will be
outlined in the plan to facilitate simpler execution of the operations. Key activities to be carried
out include developing a properly prioritized list of assets to be secured after the incident, setting
up an effective communication and collaboration channel as well as ensuring that adequate
resources are set aside to cater for any eventualities arising from the incidences. These processes
are primarily meant to ensure that the necessary initial steps are followed in addressing any
security threat that the firm may be faced with.
In addition, the response plan will have an elaborate set of procedures which will dictate
how different processes will be executed. The procedures will also include schedules that
allocate sufficient time for every activity during the response phase. The importance of having a
clear set of scheduled activities is to ensure that different processes do not conflict and therefore
hinder the successful implementation of the entire response process. One major aspect that will
be considered in the response plan procedure is to have a sufficient training program that will
equip the employees with the required skills to help them detect, avert and respond appropriately
to any incidence of cyber security that may occur in the organization (Grispos, Glisson, & Storer,
2015).
Logistics
The incidence response plan will also have a clear outline of the logistics to be followed.
Depending on the nature of the incidence, the organization may have to shift its operations to
more secure places. Therefore, the plan will outline the necessary steps to be followed
transporting key functionalities of the organization to new locations (Chen, Sharman, Rao, &
Upadhyaya, 2008). Various considerations will be made before such operations are conducted.
These include the activities that will be affected, the costs incurred and the feasibility of the
entire process. Necessary mitigation steps can be taken to ensure that the transport exercise does
not cripple the operations of the company (Chen et al., 2008). For instance, the key operations of
the organization may be shifted in phases to ensure that the organization remains operational
throughout the entire process.
Furthermore, the plan outlines the different logistic companies that may be considered to
facilitate in the smooth implementation of the process. The choice of the companies will be
based on factors such as the charges incurred and the quality of the services being offered.
Finally, the plan will also include information on the various logistical records and
inventories that will be used by the firm. To cover for any uncertainties, it is prudent to have in
place mechanisms that will ensure that any logistic transactions are well documented and
recorded (Chen et al., 2008). The storage of such information will be useful in the sense that in
the future, reference can be easily made on previous transactions to obtain different information
from them. Furthermore, the records can be used in auditing by the company to track the
financial expenditure used. Besides, having well-kept records would be beneficial to the
organization in the sense that the records will be used to identify any weak areas in the entire
process and therefore rectify them.
References
Chen, R., Sharman, R., Rao, H. R., & Upadhyaya, S. J. (2008). Coordination in emergency
response management. Communications of the ACM, 51(5), 66.
Grispos, G., Glisson, W. B., & Storer, T. (2015). Security incident response criteria: A
practitioner’s perspective. arXiv preprint arXiv:1508.02526.
III. Planning Operations
Under planning and operations, several key activities will be conducted that will ensure
that the security of the entire system is well maintained. To begin with, proper communication
channels will be laid in the organization. Communication channels will ensure any urgent
information is properly relayed to the relevant personnel in due time. Furthermore, having
elaborate communication channels implies that proper protocol will be observed when
addressing key concerns in the event of a situation that may threaten the security of a system.
This observance of the protocol would subsequently enhance the sense of responsibility of
individuals in the organization as well as enforcing transparency in the organization at large
(Alsmadi, 2019).
Furthermore, proper communication will serve as an opportunity for the management of
the organization to pass across any key information on information security that may be of
relevance to their staff. This will eventually lead to appropriate response which will enhance the
success of incidence response in an organization.
Another important aspect of planning and operations is the development of an appropriate
coordination plan between different entities in an organization (Bharara, 2013). Normally, after
the occurrence of a security incident in an organization, different entities partner up to rectify the
situation. Therefore, having a clear guideline of the steps to be followed when coordinating such
partnerships will increase the chances of having a successful recovery. An elaborate coordination
scheme will further translate to a more procedural approach that can be used to evaluate the
readiness of the organization to respond to any threat to cyber security.
Another important consideration that will be factored in at the planning and operations
phase will be to come up with approaches that will facilitate the integration of new concepts in
the industry into the organization. Threats in the security systems of an organization may result
from the continuous use of outdated strategies of data security. Therefore, to tackle and prevent
such occurrences in any organization, it is important to check out for any new concepts that may
be integrated into the company to boost the overall integrity and safety of the system.
Finally, planning and operations also play an important role in the interpretation and
application of different legislation and policies that govern cyber security. Various legal
procedures can be followed by an organization following a breach in their information security
departments. Therefore, having proper knowledge on how to apply such laws for the benefit of
the organization would contribute significantly to any response program in the event of a cyberattack on the company.
Furthermore, a clear comprehension of the policies implies that the individuals tasked
with such responsibilities are in a better position of identifying any weak spots in the policies
governing the cyber security systems of the company (Alsmadi, 2019). This would then lead to
the formulation of much stronger policies which will prevent future attacks.
Iv. Incident Management
When coming up with an appropriate response plan, it is also important to factor in
incident management. Incident management refers to the set of activities that will be executed to
contain the occurrence of a security incidence in an organization. The concept of incident
management relies on several key fundamental practices. These include detection of a security
breach, reporting the incidence, assessing the incidence and finally responding to the incidence.
Collectively, these four activities constitute the first primary consideration to be factored
in when developing an appropriate incident management plan. Developing a proper incident
management team is also another crucial strategy that will be used when coming up with an
effective incident management plan. For enhanced results, the team will bring together
individuals from various departments such as cyber security, communications department, legal
affairs department and human resource department. The coordination of such individuals will
subsequently lead to a proper situation containment team.
Finally, the last strategy that will be implemented when developing an appropriate
incident management plan is nurturing a culture of performance review (Bharara, 2013). This
will be implemented to ensure that every undertaking of the incident management is assessed to
identify its weaknesses and strengths. The weak areas identified from such assessments can then
be improved on to further enhance the overall success of the incidence management activities.
Further provisions can be enforced in the incidence management plan to cater for exceptional
cases. For instance, for cases where specialized forensic analysis is required, there are several
key considerations which can be made. These include formulation of suitable policies and laws
which will allow the collection of evidence which can further be used in courts when required.
Another key consideration is being able to implement state of the art forensic analysis techniques
in the investigation, analysis and subsequent reporting of any crime against the information
system.
Furthermore, it is crucial to seek the services of skilled personnel in forensic analysis
who would contribute to the execution of the forensic investigation processes in the company. In
many instances, the combination of forensic analysis together with other forms of investigation
in an organization exponentially increases the likelihood of identifying the perpetrators of a
given cybercrime (Alsmadi, 2019). Therefore, it is important to put into consideration the key
factors that enhance the practicability of forensic analysis.
References
Alsmadi, I. (2019). Cyber Security Management. The NICE Cyber Security Framework, 243251.
Bharara, P. (2013). Cyber Security. Advances in Cyber Security, 226-234.

Purchase answer to see full
attachment