Running Head: HANDLING THE SITUATION c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c 1
IT 552 : Assignment 8-1
SNHU
HANDLING THE SITUATION c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c 2
In order to handle the security incident involving the theft of the laptop which
contains at least 20 cases with Social Security numbers of people, there is the need to
follow a robust incident response life-cycle involving preparation, detection and analysis,
containment, eradication and recovery, and post-incident activity. It would make sure
that the extent of the damage could be mitigated and controlled to the best possible
extent (Cichonski et al., 2012, p 30). c
The first step that must be taken is the enforcement of the physical device
security. It would make sure that even if the laptop is stolen, the sensitive information
cannot be assessed by the unauthorized party. Then the least privilege policy must be
introduced which would ensure that the access of sensitive information and data could
be kept under check. Then a communication pathway must be established so that the
security automation set-up could be initiated (How to Securely Handle a Lost or Stolen
Device: A Practical Workflow, 2019).
Examination of how data would be retrieved and/or destroyed
It is necessary to have a containment strategy in place so that the data that was
in the stolen laptop can be retrieved or destroyed based on the severity of the situation.
The most important aspect is decision-making i.e. whither to shut-down the system or
disable certain functions of the stolen laptop (Cichonski et al., 2012, p 44).
Some of the main criteria that must be kept in mind before recovering or
destroying the data include the potential damage and theft of the resource, the need for
preservation of evidence and time and resource needed to implement the suitable
strategy (Cichonski et al., 2012, p 46). In this case, since the information that has been
saved is sensitive and it relates to individuals who were being served by the senior
information security manager for a federal agency, the best thing to do is destroy the
HANDLING THE SITUATION c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c 3
sensitive files and information. Eradication must be done in a phased manner so that the
remediation steps could be effectively taken (Cichonski et al., 2012, p 47).
Determine the culprit
The culprit who has stolen the laptop can be identified by employing a number
of strategic approaches. For example, an incident database could be used to gather
information on real-time backlists. Similarly, the attacking host’s address can be
validated to get additional information on his online activity on the laptop (Cichonski et
al., 2012, p 46).
There is also the option to redirect the attacker or thief to a sandbox which is a form of
the containment strategy. It would help to monitor his activities and locate him
(Cichonski et al., 2012, p 44).
Committed security violations
A computer security threat is a violation of numerous computer security policies,
standard security protocols, and acceptable user policies. In this situation, the security
incident relates to the stealing of laptop from the workstation of a senior information
security manager of a federal agency is a major crime. This various security standards
and policies that have been violated include Acceptable Use Policy (AUP), Access
Control Policy (ACP), and Information Security Policy (Hayslip, 2019).
Determination of steps to prevent similar incidents
In order to prevent similar security incidents from taking place in the near future,
it is necessary to follow a functional and robust security model. For instance, there is
the need to encrypt the hard drive so that no sensitive and confidential information can
be stolen even if the device has been stolen (Hayslip, 2019). In addition to this, there is
also the need to maintain a back-up of sensitive information so that the information will
be readily available even though the laptop is not there. There is a need to introduce a
HANDLING THE SITUATION c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c 4
comprehensive laptop security policy so that the risk of a breach can be effectively
tackled (Hayslip, 2019).
Thus it is necessary to adopt a systematic and methodical approach so that the security
incident relating to the theft of laptop can be handled in the best possible manner.
References
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident
handling guide. NIST Special Publication, 800(61), 1-147.
How to Securely Handle a Lost or Stolen Device: A Practical Workflow. (2019).
Retrieved 18 July 2019, from https://blog.rapid7.com/2017/11/09/how-to-securely-
handle-a-lost-or-stolen-device-a-practical-workflow/
Hayslip, G. (2019). 9 policies and procedures you need to know about if you’re starting
a new security program. Retrieved 18 July 2019, from
https://www.csoonline.com/article/3263738/9-policies-and-procedures-you-need-to-
know-about-if-youre-starting-a-new-security-program.html
