Running Head: HANDLING THE SITUATION 1
IT 552 : Assignment 8-1
Carlos Delapaz
SNHU
July 21 ,2019
HANDLING THE SITUATION 2
In order to handle the security incident involving the theft of the laptop which
contains at least 20 cases with Social Security numbers of people, there is the need to follow
a robust incident response life-cycle involving preparation, detection and analysis,
containment, eradication and recovery, and post-incident activity. It would make sure that the
extent of the damage could be mitigated and controlled to the best possible extent (Cichonski
et al., 2012, p 30).
The first step that must be taken is the enforcement of the physical device security. It
would make sure that even if the laptop is stolen, the sensitive information cannot be assessed
by the unauthorized party. Then the least privilege policy must be introduced which would
ensure that the access of sensitive information and data could be kept under check. Then a
communication pathway must be established so that the security automation set-up could be
initiated (How to Securely Handle a Lost or Stolen Device: A Practical Workflow, 2019).
Examination of how data would be retrieved and/or destroyed
It is necessary to have a containment strategy in place so that the data that was in the
stolen laptop can be retrieved or destroyed based on the severity of the situation. The most
important aspect is decision-making i.e. whither to shut-down the system or disable certain
functions of the stolen laptop (Cichonski et al., 2012, p 44).
Some of the main criteria that must be kept in mind before recovering or destroying
the data include the potential damage and theft of the resource, the need for preservation of
evidence and time and resource needed to implement the suitable strategy (Cichonski et al.,
2012, p 46). In this case, since the information that has been saved is sensitive and it relates
to individuals who were being served by the senior information security manager for a federal
agency, the best thing to do is destroy the sensitive files and information. Eradication must be
done in a phased manner so that the remediation steps could be effectively taken (Cichonski
et al., 2012, p 47).
HANDLING THE SITUATION 3
Determine the culprit
The culprit who has stolen the laptop can be identified by employing a number of
strategic approaches. For example, an incident database could be used to gather information
on real-time backlists. Similarly, the attacking host’s address can be validated to get
additional information on his online activity on the laptop (Cichonski et al., 2012, p 46).
There is also the option to redirect the attacker or thief to a sandbox which is a form of the
containment strategy. It would help to monitor his activities and locate him (Cichonski et al.,
2012, p 44).
Committed security violations
A computer security threat is a violation of numerous computer security policies,
standard security protocols, and acceptable user policies. In this situation, the security
incident relates to the stealing of laptop from the workstation of a senior information security
manager of a federal agency is a major crime. This various security standards and policies
that have been violated include Acceptable Use Policy (AUP), Access Control Policy (ACP),
and Information Security Policy (Hayslip, 2019).
Determination of steps to prevent similar incidents
In order to prevent similar security incidents from taking place in the near future, it is
necessary to follow a functional and robust security model. For instance, there is the need to
encrypt the hard drive so that no sensitive and confidential information can be stolen even if
the device has been stolen (Hayslip, 2019). In addition to this, there is also the need to
maintain a back-up of sensitive information so that the information will be readily available
even though the laptop is not there. There is a need to introduce a comprehensive laptop
security policy so that the risk of a breach can be effectively tackled (Hayslip, 2019).
Thus it is necessary to adopt a systematic and methodical approach so that the security
incident relating to the theft of laptop can be handled in the best possible manner.
HANDLING THE SITUATION 4
References
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident
handling guide.ANIST Special Publication,A800(61), 1-147.
How to Securely Handle a Lost or Stolen Device: A Practical Workflow. (2019). Retrieved
18 July 2019, from https://blog.rapid7.com/2017/11/09/how-to-securely-handle-a-lost-
or-stolen-device-a-practical-workflow/
Hayslip, G. (2019). 9 policies and procedures you need to know about if you’re starting a
new security program. Retrieved 18 July 2019, from
https://www.csoonline.com/article/3263738/9-policies-and-procedures-you-need-to-
know-about-if-youre-starting-a-new-security-program.html
