1. Purpose and scope
When monitoring finds that a vulnerability is being exploited or an attack has happened, the item needs a fast and controlled response. The incident response plan sets roles, communication, decision rights and the steps from triage to closure, and it is rehearsed before it is needed.
Remediation may be a software fix delivered through an update campaign, a back-end change, a change in production or service, or a temporary measure while a fix is built. Communication matters as much as the fix: customers, approval authorities, partners and sometimes the public must be told what they need to know, at the right time.
In scope: incident triage and classification, containment, root cause analysis, remediation, communication, closure and lessons learned. Out of scope: routine vulnerability management without an incident, which stays in Monitoring & Vulnerability Management.
12 more sections for registered members.