Emergency response methods and capabilities

table of Contents

Emergency response methods and capabilities

1) Data collection, storage and retrieval capabilities

2) Incident discovery ability

3) Incident analysis ability

4) Incident research and judgment ability

5) Incident handling capability

6) Attack source traceability

---

Emergency response methods and capabilities

Network security incidents occur from time to time, among which major and particularly serious network security incidents may also occur at any time. Therefore, we must make emergency preparations and establish a fast and effective modern emergency coordination mechanism to ensure that in the event of a network security incident, we can quickly organize and research based on relevant information, quickly command and dispatch relevant departments to implement emergency plans, and respond well. Avoid causing major impacts and major losses. Institutions and enterprises' cybersecurity emergency response should have the following capabilities.

1) Data collection, storage and retrieval capabilities

(1) Able to restore the full flow data protocol;

(2) Able to store the restored data;

(3) The stored data can be quickly retrieved.

2) Incident discovery ability

(1) Able to detect Advanced Persistent Threat (APT) attacks;

(2) Web attacks can be found;

(3) Data leakage can be found;

(4) The lost host can be found;

(5) Be able to find weak passwords and corporate passwords;

(6) Abnormal behavior of the host can be found.

3) Incident analysis ability

(1) Able to conduct multi-dimensional association analysis;

(2) It can restore the complete kill chain;

(3) Able to conduct in-depth analysis in combination with specific businesses.

4) Incident research and judgment ability

(1) Be able to determine the motive and purpose of the attacker;

(2) Able to determine the impact area and scope of the incident;

(3) The technique of the attacker can be determined.

5) Incident handling capability

(1) The normal operation of the business can be resumed in the first time;

(2) Able to deal with viruses and Trojan horses found;

(3) The vulnerabilities used by attackers can be repaired;

(4) The problematic machine can be strengthened safely.

6) Attack source traceability

(1) Have the ability to secure big data;

(2) Based on the existing clues (IP address, samples, etc.), the attacker's attack path, attack method and back organization can be restored.

---