☢️ 7 Phases of Incident Response

[1. Preparation, 대비]
* 잠재적 사고에 대비
* 위험 평가, 잠재적 취약점 평가, 통신채널 확립, Business Continuity 계획 수립

[2. Identification, 식별]
* Cyber Incident발생 탐지, 확인
* 사이버 공격을 받은건지 평가, 공격의 세기, 유형에 따라 보안 사고를 분류

[3. Containment, 격리]
* 식별된 Incident의 영향을 제한하고 확산을 방지

[4. Eradication, 근절]
* Incident 원인 조사, 위협 제거

[5. Recovery, 복구]
* 사고 발생 전 단계로 영향받은 시스템을 복원

[6. Lessons Learned, 교훈]
* 경험을 통해 보안자세, 사고 대응 계획에서 개선
NOTE: Lessons learned meeting, Analyzing incident

[7. Ongoing Improvement, 지속적인 개선]
* 정기적 테스트와 평가
NOTE: Tabletop Exercise, Parallel testing, Tool testing

-=======================================================-

:IR plan 수립시 피해야할것:
* 백업 테스트를 안함
* 사고 대응 리테이너 없음
* 명확한 명령 체계가 없음
* 계획을 정기적으로 검토하고 테스트하지 않음

:조직에 맞게 맞춤화하려면:
* Crown Jewels 위치 식별 및 문서화
* 잠재적 위기 평가
* 직원 역할 및 책임 확립
* 조직의 보안 정책 개요