Overview
A computer security incident response team (CSIRT) determines if a breach has occurred and how it must be handled. The CSIRT team functions according to predefined actions described in a CSIRT plan. When a security breach happens, the CSIRT team will identify, analyze, and contain the security breach, and finally remove the cause of the breach. The CSIRT team aids in all aspects of recovering from the breach. Based on the circumstances surrounding the breach, the CSIRT team will improve its CSIRT plan based on lessons learned. In this assignment, you will research CSIRT response online, describe how a CSIRT plan can mitigate risk, identify where CSIRT monitoring and security operations occur throughout an IT infrastructure, identify countermeasures and security controls that can mitigate risk, and develop a CSIRT response plan.
Instructions
- Complete the reading for the week of the NSIT publication NSIT SP 800-61.
Assignment Criteria
Your assignment must meet these criteria. Please refer to the rubric for this assignment.
- Describe how a CSIRT plan helps mitigate risks across the seven domains of an IT infrastructure.
- Identify where CSIRT security operations and monitoring occur across an IT infrastructure.
- Identify security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response.
- Create a CSIRT response plan for an IT infrastructure using incident response methodology described in NSIT SP 800-61.
- Use style and vocabulary generally appropriate to the message and intended audience.
Assignment Requirements
- Computer Incident Response Team (CSIRT) Plan: The Computer Incident Response Team Plan Template [DOCX] is considered a professional document. See the Writing CenterLinks to an external site. for helpful resources.
- Written communication: Written communication is free of errors that detract from the overall message.
- APA formatting: Resources and citations are formatted according to APA style and formatting.
- Font and font size: Times New Roman, 12 point.
Competencies Measured
By successfully completing this assignment, you will demonstrate your proficiency in the following course competencies and rubric criteria:
- Competency 4: Apply risk mitigation strategies and actions that reduce risk to organization due to identified information technology systems vulnerabilities.
- Identify security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response.
- Create a CSIRT response plan for an IT infrastructure using incident response methodology described in NSIT SP 800-61.
- Competency 5: Analyze the how administrative, technical and physical controls work together to manage risk in an organization.
- Describe how a CSIRT plan helps mitigate risks across the seven domains of an IT infrastructure.
- Identify where CSIRT security operations and monitoring occur across an IT infrastructure
- Competency 6: Communicate effectively to a range of professional and technical audiences.
- Use style and vocabulary generally appropriate to the message and intended audience.
View RubricCreating a CSIRT Response Plan for an IT InfrastructureCreating a CSIRT Response Plan for an IT InfrastructureCriteriaRatingsPtsDescribe how a CSIRT plan helps mitigate risks across the seven domains of an IT infrastructure.33 to >28.05 ptsDISTINGUISHEDDescribes how a CIRT plan helps mitigate risks across the seven domains of an IT infrastructure and provides supporting examples.28.05 to >23.1 ptsPROFICIENTDescribes how a CIRT plan helps mitigate risks across the seven domains of an IT infrastructure.23.1 to >0 ptsBASICDescribes how a CIRT plan helps mitigate risks across some of the domains of an IT infrastructure.0 ptsNON_PERFORMANCEDoes not describe how a CIRT plan helps mitigate risks across the seven domains of an IT infrastructure./ 33 ptsIdentify where CSIRT security operations and monitoring occur across an IT infrastructure33 to >28.05 ptsDISTINGUISHEDIdentifies where CIRT security operations and monitoring occur across an IT infrastructure and provides supporting examples.28.05 to >23.1 ptsPROFICIENTIdentifies where CIRT security operations and monitoring occur across an IT infrastructure.23.1 to >0 ptsBASICIdentifies some of the areas where CIRT security operations and monitoring occur across an IT infrastructure.0 ptsNON_PERFORMANCEDoes not identify where CIRT security operations and monitoring occur across an IT infrastructure./ 33 ptsIdentify security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response.33 to >28.05 ptsDISTINGUISHEDIdentifies security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response. Provides a rationale for the selection of the security controls and countermeasures.28.05 to >23.1 ptsPROFICIENTIdentifies security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response.23.1 to >0 ptsBASICIdentifies some of the security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response.0 ptsNON_PERFORMANCEDoes not identify security controls and countermeasures that will mitigate risk across the IT infrastructure and which will aid in a security incident response./ 33 ptsCreate a CSIRT response plan for an IT infrastructure using incident response methodology described in NSIT SP 800-61.36 to >30.6 ptsDISTINGUISHEDCreates a CIRT response plan for an IT infrastructure using the six-step incident response methodology applied to a given context.30.6 to >25.2 ptsPROFICIENTCreates a CIRT response plan for an IT infrastructure using the six-step incident response methodology.25.2 to >0 ptsBASICCreates a CIRT response plan for an IT infrastructure, but does not use the six-step incident response methodology.0 ptsNON_PERFORMANCEDoes not create a CIRT response plan for an IT infrastructure using the six-step incident response methodology./ 36 ptsUse style and vocabulary generally appropriate to the message and intended audience.15 to >12.75 ptsDISTINGUISHEDUses style and vocabulary fully appropriate to the message and intended audience.12.75 to >10.5 ptsPROFICIENTUses style and vocabulary generally appropriate to the message and intended audience.10.5 to >0 ptsBASICUses style and vocabulary somewhat appropriate to the message and intended audience.0 ptsNON_PERFORMANCEDoes not use style and vocabulary appropriate to the message and intended audience./ 15 ptsTotal Points: 0