Slow down. Think. Follow procedures.
In the heat of the moment... when an incident has been discovered, rushed decision-making may not be effective. By setting up policies, procedures, and agreements in advance, you minimize the chance of making cata$trophic mistakes. This is why even the most experienced incident handling experts follow well defined and systematic procedures for responding to security-related incidents. They keep the six stages in mind -- preparation, detection, containment, eradication, recovery, and follow-up; they use pre-designed forms; and they call on others for help.
Computer Security Incident Handling reflects the experience of incident handlers from more than 50 commercial, government and educational organizations. It is the first step in creating a set of incident handling procedures tailored to your organization's environment. Buy this book now and start reading. (Version 2.3.1, March 2003)
Stephen is a graduate of Mary Washington College. Before entering the field of computer security he worked as a US Navy helicopter search and rescue creman, white water raft guide, martial arts instructor, cartographer and network designer. He was the original developer of the Shadow intrusion detection system and served as the leader of the Department of Defense's Shadow Intrusion Detection Team for two years. He is the program manager for the Level One Information Security educational program and he currently serves as Chief for Information Warfare at the Ballistic Missile Defense Organization.