Sec 280 Week 6 Gem Infosys

Lee HeardProfessor CianciottaSEC-280April 10, 2014Incident-Response PolicyThe following document lays the framework for the corporate response to technologically perceived or discovered threats. This document will describe in detail the steps that should be taken in response to such an attack. This document is laid out in the general steps that should be taken in response to an attack. Depending upon the fluid situation of an attack some steps might have to be completed before another previous step. There should be a clear and concise list of phone numbers to a central information security office. This office should be manned 24/7 to accept reports of attacks to the system. These number should be handed out to whoever might be able to report such an attack in process. Some of these people who might discover such an attack could be systems administrators, IDS managers, general employees/managers, white-hat hackers testing the systems, or database personnel. There should be a chain of command as far as contact is concerned. When a real or perceived threat is reported there should be a severity level assigned so that one person is contacted for a level 1, two people are contacted for a level 2,