Editing Computer security (section)

==Computer security incident management==
[[Computer security incident management]] is an organized approach to addressing and managing the aftermath of a computer security incident or compromise with the goal of preventing a breach or thwarting a cyberattack. An incident that is not identified and managed at the time of intrusion typically escalates to a more damaging event such as a [[data breach]] or system failure. The intended outcome of a computer security incident response plan is to contain the incident, limit damage and assist recovery to business as usual. Responding to compromises quickly can mitigate exploited vulnerabilities, restore services and processes and minimize losses.<ref>{{cite web|url=https://www.icims.com/gc/incident-response-procedures/|access-date=2021-03-13| publisher=iCIMS | title= The Leading Cloud Recruiting Software}}</ref>
Incident response planning allows an organization to establish a series of best practices to stop an intrusion before it causes damage. Typical incident response plans contain a set of written instructions that outline the organization's response to a cyberattack. Without a documented plan in place, an organization may not successfully detect an intrusion or compromise and stakeholders may not understand their roles, processes and procedures during an escalation, slowing the organization's response and resolution.

There are four key components of a computer security incident response plan:
# Preparation: Preparing stakeholders on the procedures for handling computer security incidents or compromises
# Detection and analysis: Identifying and investigating suspicious activity to confirm a security incident, prioritizing the response based on impact and coordinating notification of the incident
# Containment, eradication and recovery: Isolating affected systems to prevent escalation and limit impact, pinpointing the genesis of the incident, removing malware, affected systems and bad actors from the environment and restoring systems and data when a threat no longer remains
# Post incident activity: Post mortem analysis of the incident, its root cause and the organization's response with the intent of improving the incident response plan and future response efforts.<ref>Wilcox, S. and Brown, B. (2005) 'Responding to Security Incidents – Sooner or Later Your Systems Will Be Compromised', ''Journal of Health Care Compliance'', 7(2), pp. 41–48</ref>