Re: Got IDS installed, now need incident response plan document

Hi Bryan -

Here are two books that may help.

"Writing Information Security Policies", by Scott Barman and
"Incident Response: A Strategic Guide to Handling System and Network Security Breaches", by Dr. Gene Schultz and Russell Shumway

Of the two, the incident response book may give you more short-term benefit, but from the sounds of it, the security policy book will probably help you as well.

George Capehart's advice is spot on. Don't let yourself get rushed into putting out a plan. That path will likely do more harm than good long term. Educate your boss!

Writing an IR plan isn't "War and Peace", but it isn't something one can just toss off, either.

Hope this helps.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Randy

At 12:54 AM 5/16/2003 +0000, Bryan Morris wrote:
>Hello,

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at: http://www.securityfocus.com/IntruVert-focus-ids2