Running Head: HANDLING THE SITUATION g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g
g g g g g g g g g g 1
IT 552 : Assignment 8-1
HANDLING THE SITUATION g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g
g g g g g g g g g g g g g g g g g g g g g g g g g g g 2
In order to handle the security incident involving the theft of the laptop which
contains at least 20 cases with Social Security numbers of people, there is the need to
follow a robust incident response life-cycle involving preparation, detection and analysis,
containment, eradication and recovery, and post-incident activity. It would make sure that
the extent of the damage could be mitigated and controlled to the best possible extent
(Cichonski et al., 2012, p 30).
The first step that must be taken is the enforcement of the physical device security.
It would make sure that even if the laptop is stolen, the sensitive information cannot be
assessed by the unauthorized party. Then the least privilege policy must be introduced
which would ensure that the access of sensitive information and data could be kept under
check. Then a communication pathway must be established so that the security automation
set-up could be initiated (How to Securely Handle a Lost or Stolen Device: A Practical
Workflow, 2019).
Examination of how data would be retrieved and/or destroyed
It is necessary to have a containment strategy in place so that the data that was in
the stolen laptop can be retrieved or destroyed based on the severity of the situation. The
most important aspect is decision-making i.e. whither to shut-down the system or disable
certain functions of the stolen laptop (Cichonski et al., 2012, p 44).
Some of the main criteria that must be kept in mind before recovering or destroying
the data include the potential damage and theft of the resource, the need for preservation of
evidence and time and resource needed to implement the suitable strategy (Cichonski et al.,
2012, p 46). In this case, since the information that has been saved is sensitive and it
relates to individuals who were being served by the senior information security manager
for a federal agency, the best thing to do is destroy the sensitive files and information.
HANDLING THE SITUATION g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g
g g g g g g g g g g g g g g g g g g g g g g g g g g g 3
Eradication must be done in a phased manner so that the remediation steps could be
effectively taken (Cichonski et al., 2012, p 47).
Determine the culprit
The culprit who has stolen the laptop can be identified by employing a number of
strategic approaches. For example, an incident database could be used to gather
information on real-time backlists. Similarly, the attacking host’s address can be validated
to get additional information on his online activity on the laptop (Cichonski et al., 2012, p
46).
There is also the option to redirect the attacker or thief to a sandbox which is a form of the
containment strategy. It would help to monitor his activities and locate him (Cichonski et
al., 2012, p 44).
Committed security violations
A computer security threat is a violation of numerous computer security policies,
standard security protocols, and acceptable user policies. In this situation, the security
incident relates to the stealing of laptop from the workstation of a senior information
security manager of a federal agency is a major crime. This various security standards and
policies that have been violated include Acceptable Use Policy (AUP), Access Control
Policy (ACP), and Information Security Policy (Hayslip, 2019).
Determination of steps to prevent similar incidents
In order to prevent similar security incidents from taking place in the near future, it
is necessary to follow a functional and robust security model. For instance, there is the
need to encrypt the hard drive so that no sensitive and confidential information can be
stolen even if the device has been stolen (Hayslip, 2019). In addition to this, there is also
the need to maintain a back-up of sensitive information so that the information will be
readily available even though the laptop is not there. There is a need to introduce a
HANDLING THE SITUATION g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g g
g g g g g g g g g g g g g g g g g g g g g g g g g g g 4
comprehensive laptop security policy so that the risk of a breach can be effectively tackled
(Hayslip, 2019).
Thus it is necessary to adopt a systematic and methodical approach so that the security
incident relating to the theft of laptop can be handled in the best possible manner.
References
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident
handling guide. NIST Special Publication, 800(61), 1-147.
How to Securely Handle a Lost or Stolen Device: A Practical Workflow. (2019). Retrieved
18 July 2019, from https://blog.rapid7.com/2017/11/09/how-to-securely-handle-a-lost-
or-stolen-device-a-practical-workflow/
Hayslip, G. (2019). 9 policies and procedures you need to know about if you’re starting a
new security program. Retrieved 18 July 2019, from
https://www.csoonline.com/article/3263738/9-policies-and-procedures-you-need-to-
know-about-if-youre-starting-a-new-security-program.html
