Professional Documents
Culture Documents
13.2.2.13 Lab - Incident Handling
13.2.2.13 Lab - Incident Handling
Objectives
Apply your knowledge of security incident handling procedures to formulate questions about given incident
scenarios.
Background / Scenario
Computer security incident response has become a vital part of any organization. The process for handling a
security incident can be complicated and involve many different groups. An organization must have standards
for responding to incidents in the form of policies, procedures, and checklists. To properly respond to a
security incident, the security analyst must be trained to understand what to do, and must also follow all of the
guidelines outlined by the organization. There are many resources available to help organizations create and
maintain a computer incident response handling policy, but the NIST Special Publication 800-61 is specifically
called by the CCNA CyberOps SECOPS exam topics. This publication can be found here:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Cisco and/or its affiliates. All rights reserved. Cisco Confidential Page 1 of 3 www.netacad.com
Lab – Incident Handling
Cisco and/or its affiliates. All rights reserved. Cisco Confidential Page 2 of 3 www.netacad.com
Lab – Incident Handling
Preparation:
I'll see that equipment, such as surveillance cameras, are mounted on the device.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Detection and Analysis:
I'll attempt to gain access to the access control and security camera systems in
_______________________________________________________________________________________
order to obtain evidence if an intruder is present.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Containment, Eradication, and Recovery:
I_______________________________________________________________________________________
scanned for facts and reported on who was involved as well as the aftermath. Take
steps to reduce the effect, inform the appropriate agency, and preserve evidence if
_______________________________________________________________________________________
necessary.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Post-Incident Activity:
I'll teach people who manage organizational information how to prevent similar
_______________________________________________________________________________________
accidents in the future, and I'll recommend increased personal security and improved
_______________________________________________________________________________________
access control.
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
Cisco and/or its affiliates. All rights reserved. Cisco Confidential Page 3 of 3 www.netacad.com