Computer and network security Incident investigation form Assignment goal - To learn about IT security incident investigations Assignment background You are on the IT security team for your...

Computer and network security Incident investigation form

Assignment goal - To learn about IT security incident investigations

Assignment background

You are on the IT security team for your organization. Your team just received a call about a potential computer/network security breach andyour manager asked you to investigate the incident. Due to poorplanning your team has no way of properly recording such incidents. You have now beentasked with developing a formthat can be used to document future computer/network security incidents and subsequentinvestigations.

Assignment tasks

Develop a form that can be used to document computer/network security incidents and subsequent investigations. What should be on the form? What do you think are the important things to record and keep ongoing track off following an IT security event?

To receive credit please upload an MS Word, MS Excel or .PDF document that contains this form. For tips on finding what should be on this form you might want to try this link to theNew York State Cyber incident response policy

Please note that I am not looking for you to makeup and document a computer/network security incident. I amsimply looking for you to develop a blank form that can used todocument such incidents.

Forms should clearly provide at aminimumways of documentingthe following items

Items

1. Date/time/location of the incident


2. Description of the incident and it's incident category(you can use the NY State incident category categories found in table 4.2of the above NY State link or mix and match this with your own ideas).


3. Clear way of indicating whether or not the incident reported on this form was a confirmed Computer/Network security event and whether the incident is open or closed.


4. Easily visible indicator of the severity of the incident (you can use table 4.3 found in the NY State link listed to determine these values or mix and match these with your own ideas).


5. What the impact of the incident is on the organization (was any data/equipment/intellectualproperty stolen/compromised/modified), how contained or widespread the event is/was.


6. What evidence was gathered


7. What the next steps are