RISK-BASED SECURITY INCIDENT RESPONSE (SIR); AND AN INTRODUCTION TO SICON

No ratings

Presented at BsidesCa 2017 by

Keith Jonah

Kevin Pietersma

An alternative method to design and implement a kick-ass Security Incident Management life cycle (distilled from NASA) and RACI. Now introduce the concept of "non-linear starts", then add an innovative, risk-based decisioning approach which introduces parameters related to: • potential business impact; • current impact (in situ assessment); and • the Security Incident Condition (SICON), the degree of compromise. The arrived at Security Incident Severity Level allows SOC and SIRT members to immediately direct tasks, notifications and responses in tune with owners' business prerogatives.