SCC Incident Response Plan Project – Description
Assignment Content
The health care organization IT staff has notified the CISO that one of the new NewTab iPads® has been misplaced, though it is not known if it was lost or stolen. The NewTab information system does not have a mobile device management capability that could track and wipe the device before the sensitive data on the device can be compromised.
Refer to the NewTab Project Profile as you complete Parts A and B below.
Part A: Create an Incident Response Plan
Create a incident response plan (IRP) specifically for the NewTab missing iPad incident, based on the 4 major components of incident response. Include the following in the IRP:
Introduction
Bulleted list of key stakeholders on the health care organization’s Response Team for the NewTab information system
Bulleted list of compliance/regulatory requirements with respect to the health care organization and NewTab information system
Component 1: Discovery, including the following:
Events that should be logged and monitored with respect to the NewTab information system
How the lost or stolen iPad® incident was discovered and reported
Component 2: Escalation, including the following:
Bulleted list of what triggers an event into an incident with respect to the NewTab information system
Bulleted list of the severity of impact
Summary of the steps for escalating the NewTab incident
Component 3: Response, including the following:
Summary of the planned response for the NewTab incident, including the following:
Response to the notification of the NewTab incident
Notification of applicable members on the Response Team
Summary of the response
Component 4: Reporting and Lessons Learned, including the following:
Summary of who participates in the lessons learned for the NewTab information system incident
Part B: Create a Penetration Testing Agreement
Based on the recent incident with the NewTab information system, the CISO has been tasked with hiring a vendor to conduct independent penetration testing on the NewTab information system.
A penetration test agreement is very important to ensuring that both parties, the penetration tester and the client (your company), understand the purpose and scope of the penetration test.
Create a penetration testing agreement for the NewTab information system with the major sections listed below. Include the purpose and examples for each section.
Scope for testing of the NewTab information system, including the following:
Compliance/regulatory requirements
Internal or external testing or both
Technical testing
Physical security testing
Threat identification (i.e., who and what are the threats to the NewTab information system)
Legal issues that must be considered
Components to be tested, including the following:
Gathering publicly available information
Network scanning
System/application scanning
Privilege escalation
Submit your IRP and testing agreement.
The post SCC Incident Response Plan Project first appeared on .
