Planning for Incident Response

What should you do? A hacker has penetrated your network and turned a server into a bot. You have a choice of closing the firewall down, closing the inner network down, closing the server down, or keeping everything up. Except the last, each of these might stymie the attacker, but what is it also doing to your organization’s business? IT must closely coordinate with management what should happen under such conditions, and document them in an Incident Response Plan. The plan should cover details of the stages of identification, containment and escalation, analysis and eradication, recovery and lessons learned.