Table Of ContentPrinciples of Incident Response
and Disaster Recovery
Second Edition
Michael E. Whitman
Ph.D., CISM, CISSP
Herbert J. Mattord
Ph.D., CISM, CISSP
Andrew Green
MSIS Kennesaw State University
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
This is an electronic version of the print textbook. Due to electronic rights restrictions, some third party content may be suppressed. Editorial
review has deemed that any suppressed content does not materially affect the overall learning experience. The publisher reserves the right to
remove content from this title at any time if subsequent rights restrictions require it. For valuable information on pricing, previous
editions, changes to current editions, and alternate formats, please visit www.cengage.com/highered to search by
ISBN#, author, title, or keyword for materials in your areas of interest.
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
PrinciplesofIncidentResponse& ©2014CourseTechnology,CengageLearning
DisasterRecovery,SecondEdition
ALLRIGHTSRESERVED.Nopartofthisworkcoveredbythe
Michael E.Whitman,Herbert copyrighthereinmaybereproduced,transmitted,storedorused
J.Mattord,AndrewGreen inanyformorbyanymeansgraphic,electronic,ormechanical,
includingbutnotlimitedtophotocopying,recording,scanning,
VicePresident,Careers&Computing:
digitizing,taping,Webdistribution,informationnetworks,
DaveGarza orinformationstorageandretrievalsystems,exceptaspermitted
AcquisitionsEditor:NickLombardi underSection107or108ofthe1976UnitedStatesCopyrightAct,
withoutthepriorwrittenpermissionofthepublisher.
ProductDevelopmentManager:
LeighHefferon
Forproductinformationandtechnologyassistance,contactusat
SeniorProductManager: CengageLearningCustomer&SalesSupport,1-800-354-9706
MichelleRuelosCannistraci
Forpermissiontousematerialfromthistextorproduct,
BrandManager:KristinMcNary submitallrequestsonlineatcengage.com/permissions
Furtherpermissionsquestionscanbeemailedto
MarketingDevelopmentManager:
[email protected]
MarkLinton
MarketingCoordinator:
LibraryofCongressControlNumber:2013932024
ElizabethMurphy
ISBN-13:978-1-111-13805-9
SeniorProductionDirector:
WendyTroeger ISBN-10:1-111-13805-2
ProductionManager:AndrewCrouth CourseTechnology
20ChannelCenterStreet
SeniorContentProjectManager:
Boston,MA02210
AndreaMajot
USA
ArtDirector:GEX CengageLearningisaleadingproviderofcustomizedlearning
solutionswithofficelocationsaroundtheglobe,including
Coverimage:iStock.com
Singapore,theUnitedKingdom,Australia,Mexico,Brazil,and
Japan.Locateyourlocalofficeat:international.cengage.com/region
CengageLearningproductsarerepresentedinCanadabyNelson
Education,Ltd.
Foryourlifelonglearningsolutions,visit
www.cengage.com/coursetechnology
Purchaseanyofourproductsatyourlocalcollegestoreoratour
preferredonlinestorewww.cengagebrain.com
Visitourcorporatewebsiteatcengage.com.
Someoftheproductnamesandcompanynamesusedinthisbookhavebeenusedforidentificationpurposesonlyandmaybetrademarksor
registeredtrademarksoftheirrespectivemanufacturersandsellers.
AnyfictionaldatarelatedtopersonsorcompaniesorURLsusedthroughoutthisbookisintendedforinstructionalpurposesonly.Atthetime
thisbookwasprinted,anysuchdatawasfictionalandnotbelongingtoanyrealpersonsorcompanies.
CourseTechnologyandtheCourseTechnologylogoareregisteredtrademarksusedunderlicense.
CourseTechnology,apartofCengageLearning,reservestherighttorevisethispublicationandmakechangesfromtimetotimeinits
contentwithoutnotice.
Theprogramsinthisbookareforinstructionalpurposesonly.Theyhavebeentestedwithcare,butarenotguaranteedforanyparticular
intentbeyondeducationalpurposes.Theauthorandthepublisherdonotofferanywarrantiesorrepresentations,nordotheyacceptany
liabilitieswithrespecttotheprograms.
Printed in the United States of America
1 2 3 4 5 6 7 16 15 14 13
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
To Rhonda, Rachel, Alex, and Meghan, thank you for your loving support.
—MEW
To my daughter, Becky. Always stay strong.
—HJM
For my nieces, Lexidoodle and Alliecat, and my nephew Timmy.
—AG
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
Brief Contents
PREFACE. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER 1
AnOverviewofInformation SecurityandRisk Management .. ... ... .. ... ... .. ... ... .. ... .. 1
CHAPTER 2
PlanningforOrganizational Readiness.. ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 47
CHAPTER 3
ContingencyStrategies forIR/DR/BC ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 89
CHAPTER 4
IncidentResponse:Planning.. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 131
CHAPTER 5
IncidentResponse:Detection andDecision Making... .. ... .. ... ... .. ... ... .. ... ... .. ... 165
CHAPTER 6
IncidentResponse:Organizing andPreparingtheCSIRT . ... .. ... ... .. ... ... .. ... ... .. ... 231
CHAPTER 7
IncidentResponse:ResponseStrategies. ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 267
CHAPTER 8
IncidentResponse:Recovery andMaintenance ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 313
CHAPTER 9
DisasterRecovery:PreparationandImplementation .. .. ... .. ... ... .. ... ... .. ... ... .. ... 369
CHAPTER 10
DisasterRecovery:OperationandMaintenance... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 409
CHAPTER 11
BusinessContinuity Planning. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 437
CHAPTER 12
CrisisManagementandInternational StandardsinIR/DR/BC . .. ... ... .. ... ... .. ... ... .. ... 477
APPENDIX A
SampleBusinessContinuity Plan forABCCo. . ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 529
APPENDIX B
ContingencyPlan Templatefrom theComputerSecurityResource Centerat
theNationalInstitute of StandardsandTechnology .. .. ... .. ... ... .. ... ... .. ... ... .. ... 537
APPENDIX C
SampleCrisis ManagementPlan forHierarchical Access, Ltd.. .. ... ... .. ... ... .. ... ... .. ... 565
GLOSSARY .. ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 577
INDEX. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 583
v
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
Table of Contents
PREFACE. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER 1
AnOverviewofInformation SecurityandRisk Management .. ... ... .. ... ... .. ... ... .. ... .. 1
OpeningCaseScenario:PerniciousProxyProbing.............................................. 2
Introduction......................................................................... 2
InformationSecurity................................................................... 3
KeyInformationSecurityConcepts ..................................................... 4
OverviewofRiskManagement.......................................................... 12
KnowYourself................................................................... 13
KnowtheEnemy................................................................. 14
RiskIdentification ................................................................ 14
RiskAssessment.................................................................. 18
RiskControlStrategies............................................................. 21
ContingencyPlanningandItsComponents.................................................. 23
BusinessImpactAnalysis............................................................ 23
IncidentResponsePlan............................................................. 23
DisasterRecoveryPlan............................................................. 24
BusinessContinuityPlan............................................................ 25
ContingencyPlanningTimeline....................................................... 25
RoleofInformationSecurityPolicyinDevelopingContingencyPlans............................... 29
KeyPolicyDefinitions.............................................................. 30
EnterpriseInformationSecurityPolicy.................................................. 31
Issue-SpecificSecurityPolicy......................................................... 31
Systems-SpecificPolicy ............................................................. 33
PolicyManagement ............................................................... 34
ChapterSummary ................................................................... 34
ReviewQuestions.................................................................... 36
Real-WorldExercises ................................................................. 37
Hands-OnProjects................................................................... 37
Virtualization.................................................................... 37
EthicalConsiderationsintheUseofInformationSecurityTools................................ 38
Example .......................................................................... 41
ClosingCaseScenario:PonderingPeople................................................... 42
Endnotes.......................................................................... 44
CHAPTER 2
PlanningforOrganizational Readiness.. ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 47
OpeningCaseScenario:ProperPlanningPreventsProblems...................................... 48
Introduction........................................................................ 49
BeginningtheContingencyPlanningProcess................................................. 49
CommitmentandSupportofSeniorManagement.......................................... 51
ElementsRequiredtoBeginContingencyPlanning ............................................ 52
ContingencyPlanningPolicy............................................................ 54
ASampleGenericPolicyandHigh-LevelProceduresforContingencyPlans .......................... 55
vii
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
viii TableofContents
BusinessImpactAnalysis .............................................................. 57
DetermineMission/BusinessProcessesandRecoveryCriticality ................................ 58
IdentifyResourceRequirements....................................................... 62
IdentifySystemResourceRecoveryPriorities ............................................. 63
BIADataCollection.................................................................. 64
OnlineQuestionnaires ............................................................. 64
FacilitatedData-GatheringSessions.................................................... 71
ProcessFlowsandInterdependencyStudies .............................................. 72
RiskAssessmentResearch........................................................... 75
ITApplicationorSystemLogs ....................................................... 75
FinancialReportsandDepartmentalBudgets ............................................. 75
AuditDocumentation.............................................................. 76
ProductionSchedules .............................................................. 76
BudgetingforContingencyOperations..................................................... 76
IncidentResponseBudgeting......................................................... 76
DisasterRecoveryBudgeting......................................................... 77
BusinessContinuityBudgeting........................................................ 78
CrisisManagementBudgeting........................................................ 79
ChapterSummary ................................................................... 79
ReviewQuestions.................................................................... 80
Real-WorldExercises ................................................................. 81
Hands-OnProjects................................................................... 82
ClosingCaseScenario:OutrageouslyOddOutages............................................ 86
Endnotes.......................................................................... 86
CHAPTER 3
Contingency StrategiesforIR/DR/BC .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... .. 89
OpeningScenario:PanickingoverPowder .................................................. 90
Introduction........................................................................ 91
DataandApplicationResumption........................................................ 93
OnlineBackupsandtheCloud ....................................................... 94
DisktoDisktoOther:DelayedProtection............................................... 94
Redundancy-BasedBackupandRecoveryUsingRAID ...................................... 98
DatabaseBackups ............................................................... 100
ApplicationBackups.............................................................. 101
BackupandRecoveryPlans ........................................................ 102
Real-TimeProtection,ServerRecovery,andApplicationRecovery............................. 102
SiteResumptionStrategies ............................................................ 110
ExclusiveSiteResumptionStrategies .................................................. 110
Shared-SiteResumptionStrategies.................................................... 113
ServiceAgreements............................................................... 115
ChapterSummary .................................................................. 120
ReviewQuestions................................................................... 122
Real-WorldExercises ................................................................ 123
Hands-OnProjects.................................................................. 123
Hands-OnProject3-1:Command-lineBackupUsingrdiff-backup............................. 124
Hands-OnProject3-2:CopyingVirtualImages .......................................... 126
ClosingCaseScenario:DisasterDenied ................................................... 129
Endnotes......................................................................... 129
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part.
