Lesson 1: Identify Incidents - Detection and Analysis

You’ll learn to identify potential security incidents using monitoring and alerting systems, and human reporting.

Effective incident management starts with the ability to quickly detect security incidents. Organizations can detect incidents using two approaches:

1. Use an identification system

2. Set up a human reporting program

What does an incident identification system look like?

• Implement intrusion detection and prevention systems (IDPS) to monitor network traffic and system activity for signs of unauthorized access or malicious behavior

• Configure security information and event management (SIEM) tools to aggregate and analyze log data from various sources, such as firewalls, servers, and applications, to identify potential security events

• Deploy endpoint detection and response (EDR) solutions to monitor and detect threats on individual devices, such as workstations and servers.

• Utilize file integrity monitoring (FIM) tools to detect unauthorized changes to critical system files and configurations

• Implement data loss prevention (DLP) solutions to identify and prevent the unauthorized exfiltration of sensitive data.

What does a human reporting program look like?

• Provide regular security awareness training to all employees, covering topics such

  as identifying suspicious emails, reporting potential security incidents, and

  handling sensitive data securely.

• Establish clear and easily accessible reporting channels for employees to report

  suspected security incidents, such as a dedicated email address, phone number,

  or web portal.

• Encourage a culture of vigilance and responsibility, where employees feel

  empowered to report potential security concerns without fear of retribution.

• Develop and communicate clear guidelines for external stakeholders, such as

  customers and vendors, on how to report security incidents or vulnerabilities.