Hosting.com - First Name in Hosting

RFC2196 - Page 43


Page Navigation:

1  2  3  4  5  6  7  8  9  10  11  12  13  14  15  16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31  32  33  34  35  36  37  38  39  40  41  42  43  44  45  46  47  48  49  50  51  52  53  54  55  56  57  58  59  60  61  62  63  64  65  66  67  68  69  70  71  72  73  74  75 

Printable Version: RFC2196.PDF

<< Prev. Page     Next Page >>

RFC 2196              Site Security Handbook              September 1997


5.2.1  Local Managers and Personnel

   When an incident is under way, a major issue is deciding who is in
   charge of coordinating the activity of the multitude of players.  A
   major mistake that can be made is to have a number of people who are
   each working independently, but are not working together.  This will
   only add to the confusion of the event and will probably lead to
   wasted or ineffective effort.

   The single POC may or may not be the person responsible for handling
   the incident.  There are two distinct roles to fill when deciding who
   shall be the POC and who will be the person in charge of the
   incident.  The person in charge of the incident will make decisions
   as to the interpretation of policy applied to the event.  In
   contrast, the POC must coordinate the effort of all the parties
   involved with handling the event.

   The POC must be a person with the technical expertise to successfully
   coordinate the efforts of the system managers and users involved in
   monitoring and reacting to the attack. Care should be taken when
   identifying who this person will be.  It should not necessarily be
   the same person who has administrative responsibility for the
   compromised systems since often such administrators have knowledge
   only sufficient for the day to day use of the computers, and lack in
   depth technical expertise.

   Another important function of the POC is to maintain contact with law
   enforcement and other external agencies to assure that multi-agency
   involvement occurs.  The level of involvement will be determined by
   management decisions as well as legal constraints.

   A single POC should also be the single person in charge of collecting
   evidence, since as a rule of thumb, the more people that touch a
   potential piece of evidence, the greater the possibility that it will
   be inadmissible in court. To ensure that evidence will be acceptable
   to the legal community, collecting evidence should be done following
   predefined procedures in accordance with local laws and legal
   regulations.

   One of the most critical tasks for the POC is the coordination of all
   relevant processes.  Responsibilities may be distributed over the
   whole site, involving multiple independent departments or groups.
   This will require a  well coordinated effort in order to achieve
   overall success.  The situation becomes even more complex if multiple
   sites are involved.  When this happens, rarely will a single POC at
   one site be able to adequately coordinate the handling of the entire
   incident.  Instead, appropriate incident response teams should be
   involved.



Fraser, Ed.                Informational                       [Page 43]


<< Prev. Page     Next Page >>