Incident Response

There must be a policy for a Local Authority user to report security incidents to the local service desk OR for help desk to inform the Local Authority's management of incidents

There should be a policy for Local Authority management to both handle and manage incidents in a timely manner.

Local authorities should report security incidents to GovCERT UK and should be registered as part of a WARP.

 

Suggested Solutions

Encription Limited can work with you to set up an incident response system.

To see what Tiger Certified Encription Limited can do on give us a call 01905 754440 or  go to http://encription.co.uk/public-sector.php

 

Review, design and implement effective processes, supported by automatic security alert notification.

More information can be found here

 

StealthWatch pro-actively reports in response to incidents such as malicious activity, anomalous network behaviour or breach of Authority defined policy. Alerts can be sent into SIEM or SIM systems or directly to administrators responsible for security and performance management. StealthWatch provides the underlying detail of the incident in easy to access information through our ‘three click’ philosophy, reducing the time to diagnose and respond to the incident. For more information, contact us at international@lancope.com or visit www.lancope.com

 

LogRhythm has the capability to generate alerts within the system and also out to external systems via SNMP and SMTP, LogRhythm has a sophisticated incident response component, tracking log behaviour, correlating events, tracking ticket history and reporting on ticket status to name just a few uses.

 

Safend Data Protection Suite creates forensic logs of all user actions and data moving in and out of the organisation. With built-in alerting capability, administrators can get immediate notifications of any activity that requires an immediate response. Alerts are available via email, SNMP, Syslog, Windows Event Viewer, popup messages and even custom scripts. Read More 

 

There are specific obligations placed on organisations connecting to the GSi which may not be captured in normal incident management. These include reporting events to GovCERT UK amongst others.

Sapphire has designed a range of methodologies to capture the increasing range of security incidents and breaches. This area is crucial for management reporting including audit committees. For further information please email Coco Information or call 01642 702100.