The Incident Response Program Gap Assessment evaluates the organization’s response to incidents that occur in their environment; through testing, review, and simulating real-world incidents. This methodology ensures the IRP is properly implemented and tested, and properly follows approved policies.

An Incident Response Program Gap Assessment reviews the following:

• Preparation
• Business continuity
• Eradication/Containment procedures
• Current MSBs
• Hardening
• Network security controls

Testing is strongly recommended to identify any security exposures or threats that are missed within the current security program. To test the current security program, SecureState simulates an attacker attempting to gain remote or local access to the business networks, and exploits weaknesses to obtain as much access to sensitive information as possible. These assessments ascertain if an attacker focused their efforts on the business networks, the level of exposure and/or unauthorized access that may be obtained, and also tests the Incident Response capabilities of the organization. The exercises simulate real-world incidents that may affect data and resources, and are performed concurrently to ensure the IRP is properly implemented and tested as well as properly follows approved policies.

SecureState’s Assessment provides multiple approaches to assessing the control points, architecture, personnel, and methodologies referenced within the IRP in order to determine the overall state of response and prioritization in the security of the corporate architecture. This Gap Assessment will present key areas that should be focused on within the IRP. The Assessment specifically will examine:

• Structure of the Readiness and Response Team, including defined roles and responsibilities, and procedures
• Current logging, auditing, and monitoring inputs that drive the Incident Response Program
• Incident definition and classification
• Escalation procedures both internally and externally
• Previous Incident Response Program tabletop or mock exercise documentation
• Confidentiality, integrity, and availability of information
• Protection of sensitive information
• Ability to maintain processing during and following an emergency
• Management and employee accountability for computing resources

SecureState:

1. Has the ability to help with incident response from a hacker’s point of view
2. Knows how organizations are compromised and impacted because we do simulated hacking and continuity exercises ethically for clients on a daily basis
3. Concurrently assesses an incident’s impact and an organization’s risk controls
4. Combines data forensic, hacker, and risk perspectives
5. Provides an integrated response to determine where, when, why, and how a compromise or incident has occurred
6. Employs testing and evaluation professionals who are actively engaged in and manage relationships with DHS, FEMA, and state and local responders in addition to law enforcement
7. Employs experts who have served in advisory and design roles in the creation of MOUs and resiliency plans for the USAF and USMC

• The Importance of System Logging
• Another Reminder on Security PCI

• Internal Attack and Penetration Assessment
• External Attack and Penetration Assessment
• Incident Response Plan Development
• Test, Training and Exercise
• Audit and Compliance