From the course: SSCP Cert Prep: 4 Incident Response and Recovery

Unlock the full course today

Join today to access over 24,200 courses taught by industry experts.

Incident identification

Incident identification

From the course: SSCP Cert Prep: 4 Incident Response and Recovery

Start my 1-month free trial Buy for my team

Incident identification

“

- [Instructor] Once you have an incident response plan in place and a team prepared, the incident response process then enters a state of perpetual monitoring, watching for signs that an incident is occurring or has already taken place. There are many different ways that an organization might identify a security incident. The key to successful incident identification is having a robust security monitoring infrastructure. Data is crucial to incident detection and organizations have a responsibility to collect, analyze, and retain security information. Now, there are many different information sources that may contribute data that's crucial to identifying and analyzing a possible security incident. These include intrusion detection and prevention systems, firewalls, authentication systems, system and file integrity monitoring systems, vulnerability scanners, system event logs, netflow connection records, and anti-malware…

Contents