From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Unlock this course with a free trial

Join today to access over 23,100 courses taught by industry experts.

Incident identification

Incident identification

From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Start my 1-month free trial Buy for my team

Incident identification

“

- [Instructor] Once you have an incident response plan in place and a team prepared, the incident response process then enters a state of perpetual monitoring, watching for signs that an incident is occurring or has already taken place. There are many different ways that an organization might identify a security incident. The key to successful incident identification is having a robust security monitoring infrastructure. Data is crucial to incident detection, and organizations have a responsibility to collect, analyze, and retain security information. Now, there are many different information sources that may contribute data that's crucial to identifying and analyzing a possible security incident. These include intrusion detection and prevention systems, firewalls, authentication systems, system and file integrity monitoring systems, vulnerability scanners, system event logs, NetFlow connection records, and anti-malware packages, among many other sources. If IT systems do one thing…

Contents