6 Appendix: Note on procedure definitions
Copyright(c), 1996 - Management Analytics and Others - All Rights Reserved
Policies and statements of services in the template have to be
implemented as procedures, but descriptions of those procedures should
not be included in the template.
The following notes are intended to assist those seeking to form or to
improve their IRTs.
- identify other response teams
- define supported clients:
- by domain, through registration system, other means
- establish secure communication practices
- use of network, cell-phones, etc
- define information that a client site must/should provide
- secure the team's infrastructure
- protect information servers
- protect sensitive data
- define expiry of sensitive data
- define disposal practice for sensitive data
- establish methods for gathering and keeping statistics
- establish 'knowledge base' of lessons learned from past incidents
- create practical implementations of disclosure policies
- document explicit practices for disclosure to the Press
The Site Security Handbook is a first resource to consult in securing a
team's infrastructure. IRT-specific security measures may evolve later.