Communications of the ACM
Incident handling: an orderly response to unexpected events
SIGUCCS '03 Proceedings of the 31st annual ACM SIGUCCS fall conference
Live forensics: diagnosing your system without killing it first
Communications of the ACM - Next-generation cyber forensics
| Hi-index | 0.00 |
An incident response plan is critical for the detection and removal of information security threats. Incident response involves many aspects other than technical issues. There are management, legal, and social issues that an incident response team needs to consider. An incident response identifies, contains, and eliminates the incident. Then, the compromised system is fully recovered and restored. To hold the intruder accountable, a forensic investigation is needed. Documentation of all activities and evidence gathering is crucial when during the entire response and investigation. The paper proposes and discusses interconnected methodological frameworks for both incident response and network forensics.