Attached Lab. 2 pages

Attached Lab. 2 pages
Abstract You are first going to research a few incident response plans on the internet. Next, you are going to think about the things that you have digitally and you’ll consider how to minimize if they were lost, stolen or destroyed. Write these down and think of how you can replace them. Finally, you will develop an incident response plan for a health care company that has urgent care facilities across the city. What should be their incident response plan? Think about what data they have. Objective(s) EO1: Investigate various incident response plans EO2: Create a sample incident response plan Base Lab Incident Response (IR) refers to the steps/protocol taken whenever an incident (a data breach, for example) has occurred. Organizations may construct their own IR plan, but they’d do well to follow some of the recommendations set forth by either NIST or SANS. NIST details a four-step IR plan, whereas SANS details a six-step IR plan. The phases of the NIST IR plan are: 1. Preparation 2. Detection & Analysis 3. Containment, Eradication, & Recovery 4. Post-Incident Activity The phases of the SANS IR plan are: 1. Preparation 2. Identification 3. Containment 4. Eradication 5. Recovery 6. Lessons Learned Both are noticeably similar, and neither is “more correct” than the other. Find an article or two on each that explains what each of these steps mean. 1. Perform a search for “Incident Response Plan”. There are many websites out there to choose from. If you need help looking at some: a. https://www.cisco.com/c/en/us/products/security/incident- response-plan.html (Links to an external site.) b. https://security.berkeley.edu/incident-response-planning-guideline (Links to an external site.) c. https://www.crowdstrike.com/epp-101/incident-response-ir-plan/ (Links to an external site.) These should give you a good idea of how different organizations define incidents, and how they lay out their IR plans. 2. Think about the data and devices that you “own.” Some examples might include: ● The data on your laptop ● Pictures ● Bank account information ● Passwords ● Cloud data ● Music ● Movies ● Internet connection 3. If something were to happen to that data or to those devices, what would you do to minimize the damage? Suppose, for example, you suspect that someone is able to remotely access your personal laptop without your permission. How would you determine for sure that someone is accessing your personal data? What steps would you take to “remove” them so they no longer had access? What all could they potentially have gotten access to, and how would you minimize the impact of that data leakage? In other words, think about how you’d implement your own incident response plan. You do not need to submit this, but these are all things to consider for the next exercise. 4. Suppose you work for a health care company that has urgent care facilities throughout the city. Your job is to come up with an incident response plan. Use either the NIST or the SANS framework for guidance. Provide an overview of how you’d approach each step of the IR plan. 5. If you need help, Google incident response plan site:.edu. Interestingly enough, higher education has it down. 6. Deliverable: Submit your Incident Response Plan from step 4. This does not have to be a wildly long IR plan. Many IR plans might be a few dozen pages in length. We are not expecting this. We’d like for you to provide an overview of each phase of your IR plan. This will likely be around one page in length.