Scribd Logo
Upload

Welcome to Scribd!

  • 12 views

    OvJ7ZffUQYipLl15W7jtqQ - Incident Report Analysis Exemplar

    Uploaded by

    Walid Ali
    The document provides a template for analyzing security incidents by describing the key frameworks of Identify, Protect, Detect, Respond, and Recover. It includes an example summary of a DDoS attack where the cybersecurity team blocked the attack, stopped non-critical services to restore critical ones, and implemented new firewall rules and monitoring to prevent future attacks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    OvJ7ZffUQYipLl15W7jtqQ - Incident Report Analysis Exemplar

    Uploaded by

    Walid Ali
    12 views2 pages
    The document provides a template for analyzing security incidents by describing the key frameworks of Identify, Protect, Detect, Respond, and Recover. It includes an example summary of a DDoS attack where the cybersecurity team blocked the attack, stopped non-critical services to restore critical ones, and implemented new firewall rules and monitoring to prevent future attacks.

    Original Description:

    Cybersecurity work checklists.2

    Original Title

    OvJ7ZffUQYipLl15W7jtqQ_b5b17475eea94b6f993d55526be34bf1_Incident-report-analysis-exemplar

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides a template for analyzing security incidents by describing the key frameworks of Identify, Protect, Detect, Respond, and Recover. It includes an example summary of a DDoS attack where the cybersecurity team blocked the attack, stopped non-critical services to restore critical ones, and implemented new firewall rules and monitoring to prevent future attacks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    12 views2 pages

    OvJ7ZffUQYipLl15W7jtqQ - Incident Report Analysis Exemplar

    Uploaded by

    Walid Ali
    The document provides a template for analyzing security incidents by describing the key frameworks of Identify, Protect, Detect, Respond, and Recover. It includes an example summary of a DDoS attack where the cybersecurity team blocked the attack, stopped non-critical services to restore critical ones, and implemented new firewall rules and monitoring to prevent future attacks.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 2

    Incident report analysis

    Instructions

    As you continue through this course, you may use this template to record your findings after
    completing an activity or just to take notes on what you've learned about a specific tool or
    concept. You can also use this chart as a way to continue practicing applying the NIST CSF
    framework to different situations you may encounter.

    Summary The company experienced a security event when all network services
    suddenly stopped responding. The cybersecurity team found the disruption
    was caused by a distributed denial of services (DDoS) attack through a flood
    of incoming ICMP packets. The team responded by blocking the attack and
    stopping all non-critical network services, so that critical network services
    could be restored.

    Identify A malicious actor or actors targeted the company with an ICMP flood attack.
    The entire internal network was affected. All critical network resources needed
    to be secured and restored to a functioning state.

    Protect The cybersecurity team implemented a new firewall rule to limit the rate of
    incoming ICMP packets and an IDS/IPS system to filter out some ICMP traffic
    based on suspicious characteristics.

    Detect The cybersecurity team configured source IP address verification on the


    firewall to check for spoofed IP addresses on incoming ICMP packets and
    implemented network monitoring software to detect abnormal traffic
    patterns.

    Respond For future security events, the cybersecurity team will isolate affected
    systems to prevent further disruption to the network. They will attempt to
    restore any critical systems and services that were disrupted by the event.
    Then, the team will analyze network logs to check for suspicious and abnormal
    activity. The team will also report all incidents to upper management and
    appropriate legal authorities, if applicable.

    Recover To recover from a DDoS attack by ICMP flooding, access to network services
    need to be restored to a normal functioning state. In the future, external ICMP
    flood attacks can be blocked at the firewall. Then, all non-critical network
    services should be stopped to reduce internal network traffic. Next, critical
    network services should be restored first. Finally, once the flood of ICMP
    packets have timed out, all non-critical network systems and services can be
    brought back online.

    Reflections/Notes:

    You might also like