A forensic approach to incident response

An incident response plan is critical for the detection and removal of information security threats. Incident response involves many aspects other than technical issues. There are management, legal, and social issues that an incident response team needs to consider. An incident response identifies, contains, and eliminates the incident. Then, the compromised system is fully recovered and restored. To hold the intruder accountable, a forensic investigation is needed. Documentation of all activities and evidence gathering is crucial when during the entire response and investigation. The paper proposes and discusses interconnected methodological frameworks for both incident response and network forensics.