Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

  • Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint

Conducting Interviews

When your CSIRT learns of a suspected incident, the first step is to start asking the “who, what, when, where, and how” questions. These questions allow you to determine some facts surrounding the incident, such as the location of relevant systems, administrative contacts, what may have occurred and when, and so on. While the answer to every question may not be available, the more answers you can obtain, the easier it will be for you to assess the situation.

Caution

Avoid situations where critical information is obtained by a team member from an interview but not documented or shared with the team. Depending on the size of the incident, one person probably cannot take every investigative step. Unfortunately, the more team members involved, the more likely something will fall through the cracks. Continuity and distribution of information within the CSIRT is critical. We recommend daily briefings and open but secure communication between team members.



  

You are currently reading a PREVIEW of this book.

                                                                                                                    

Get instant access to over $1 million worth of books and videos.

  

Start a Free Trial


  
  • Safari Books Online
  • Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint