Summarize the events that lead to the discovery of the potential vulnerability. Record your summary in the attached CON Reporting Template.

INTRODUCTION
Throughout your career in cybersecurity management, you will be asked to manage and protect your company IT department to support the company strategic goals and mission. Computer security incident response is an important component of IT programs. Performing an incident response is a complex undertaking. Establishing the capability to respond successfully to an incident requires substantial planning and resources.

As a leader in a company network operations center (NOC), you will be tasked with assessing the company risk management and cybersecurity posture. As vulnerabilities and threats arise, you will be responsible for determining the who, what, when, where, and why of these events. Additionally, you will report your findings to upper management, describe how you contained these events, and provide recommendations to limit or prevent these events from happening again.

SCENARIO
You are an incident response (IR) manager working in the newly formed Network Operations Center (NOC) for Peruvian Inc. After a number of web exploits were reported in the news, the Board of Directors for Peruvian asked you to validate the company security. Following the NOCs standard operating procedure (SOP), you are asked to review the attached outputs from the vulnerability assessment and regular scans for intrusions on Peruvians systems.

Along with detecting and reporting intrusions, per the SOP, you must evaluate the vulnerability scan output to determine whether or not a vulnerability exists on the system(s) with the potential issue and provide a report to upper management for review.

REQUIREMENTS
You must use the rubric to direct the creation of your submission because it provides detailed criteria that will be used to evaluate your work. Each requirement below may be evaluated by more than one rubric aspect.

Introduction
A. Summarize the events that lead to the discovery of the potential vulnerability. Record your summary in the attached NOC Reporting Template.

Scan Summary
B. Summarize the results of the security vulnerability report, nap host scan and alarm report; including which systems and data were compromised. Be sure to address the basic assessment questions from the attached Incident Response Plan as part of your submission. Record your responses in the attached CON Reporting Template.

Detailed Analysis
C. Explain the steps you will take to identify any exploited systems and data that are included in the scope of the incident as part of your documentation in the attached CON Reporting Template.

Scan Response
D. Identify the event level of the incident, who needs to be contacted, and when should they be contacted based on the company’s incident response plan. Record your responses in the attached CON Reporting Template.

Remediation
E. Justify the interventions you will use to quarantine and remediate the compromised machine using industry best practices. Record your responses in the attached CON Reporting Template.

Recommendations
F. Recommend both administrative controls and technical controls that the CON could apply to prevent or limit the damage from a similar incident in the future. Record your recommendations in the attached CON Reporting Template.

G. Acknowledge sources, using in-text citations and references, for content that is quoted, paraphrased, or summarized.

H. Demonstrate professional communication in the content and presentation of your submission.

RECENT POSTS