SOUND THE ALARM: When Do You Make the Decision to Trigger Incident Response?

No ratings

Presented at CyberSecure 2015 by

Mark Sangster

Richard Jacobs

Vince Polley

External cyber incident, internal malfeasance, systems malfunction, or other network anomaly? When outages were reported at the New York Stock Exchange (NYSE), the Wall Street Journal and United Airlines in summer 2015, many were quick to assume that these glitches were associated with a cyber attack. Large organizations with complex systems, which can be provided and managed by third party providers, are tasked with a herculean effort of monitoring and responding to such activity, and initiating the appropriate response. Failure to response appropriately can result in significant business interruption, reputational harm, and even legal liability. This session will examine the crucial questions organizations must ask when suspicion of an attack has arisen. • How do you and your team investigate and assess when you have a legitimate security incident? • How do you classify your response, depending on the risk profile of the incident? • What are some best practices in developing an enterprise risk-based breach response program? • How can your response better assist in the discharge of legal obligations, such as notification to customers and the authorities? • Best practices for network activity triage