{"id":7115,"date":"2021-07-02T08:14:11","date_gmt":"2021-07-02T06:14:11","guid":{"rendered":"https:\/\/tekmart.co.za\/t-blog\/?p=7115"},"modified":"2021-07-02T08:14:12","modified_gmt":"2021-07-02T06:14:12","slug":"incident-response-team-a-tech-definition","status":"publish","type":"post","link":"https:\/\/tekmart.co.za\/t-blog\/incident-response-team-a-tech-definition\/","title":{"rendered":"incident response team-a tech definition"},"content":{"rendered":"Reading Time-approximately:<\/span> 3<\/span> minutes<\/span><\/span>\n

An incident response team is a group of IT professionals in charge of preparing for and reacting to any type of organizational emergency.<\/strong><\/h2>\n\n\n\n

By Wesley Chai<\/a> and Sarah Lewis<\/a><\/p>\n\n\n\n

An incident response team is a group of IT professionals in charge of preparing for and reacting to any type of organizational emergency. Responsibilities of an incident response team include\u00a0developing a proactive incident response plan, testing for and resolving system vulnerabilities, maintaining strong security best practices and providing support for all incident handling measures. Incident response team members typically cover various technical skills, backgrounds and roles to be prepared for a wide range of\u00a0unforeseen security incidents.<\/p>\n\n\n\n

In\u00a0incident response, types of emergencies are usually categorized in two ways:<\/p>\n\n\n\n

  1. Public incidents.<\/strong>\u00a0These incidents affect an entire community. This could include natural disasters, terrorist attacks and widespread epidemics.<\/li>
  2. Corporate\/organizational incidents.<\/strong>\u00a0These incidents are typically organization-specific and happen on a smaller scale. This could include\u00a0data breaches,\u00a0cybersecurity\u00a0attacks and physical location threats.<\/li><\/ol>\n\n\n\n

    Incident response teams are\u00a0trained to be prepared for both types.<\/p>\n\n\n\n

    Examples of incident response teams<\/strong><\/h3>\n\n\n\n

    Incident response teams are common in government organizations and businesses with valuable intellectual property. A few examples of the forms an incident response team could take are as follows.<\/p>\n\n\n\n

    Computer Security Incident Response Team (CSIRT).<\/strong>\u00a0This is a team of professionals responsible for preventing and responding to security incidents. A CSIRT may also handle aspects of incident response in other departments, such as dealing with legal issues or communicating with the press.<\/p>\n\n\n\n

    Computer Emergency Response Team (CERT).<\/strong>\u00a0This is a team of professionals in charge of handling cyberthreats and vulnerabilities within an organization. In addition, CERTs tend to release their findings to the public to help others strengthen their security infrastructure.<\/p>\n\n\n\n

    Security Operations Center (SOC).\u00a0<\/strong>This is a type of command center facility that is dedicated to monitoring, analyzing and protecting an organization from cyber attacks. A SOC typically includes threat hunters and analysts that focus only on system security incident response.<\/p>\n\n\n\n

    Incident response team functions and responsibilities<\/strong><\/h3>\n\n\n\n

    As companies will have different individual\u00a0risk profiles\u00a0and business processes to be mindful of, specific skillsets within the incident response team may vary. Generally speaking, the core functions of an incident response team include leadership, investigation, communications, documentation and legal representation.<\/p>\n\n\n\n