Malware Attack Incident Response - Case Study Example

Deterring and responding to the attack is important to keep the company from losing a lot more revenues. Two days net down is quite a long time for a company in business. That means the company lost so much revenue due to the inactivity of the systems. To mitigate the severity of the occurrence and the net downtime, the following policy is essential. Among the key actions are the formulation of a security response team and a policy on the recovery process.

Response team development
The security response team will be designed to respond to any security breaches. The team members must be responsible and endeavor to work to prevent security breaches. They should be available anytime time and even stop any work they are doing that is underway to deal with the impending incident. The response team should be formed by the organizational employees. Each department should be represented in the response team to ensure a holistic approach in deterring the incidences. To function optimally, the team should be bestowed with the authority to make the decisions that are needed to prevent the threat or resolve the actual malware attack (Runciman, 2011).
The team should have a leader that will help in conducting and directing the affairs of the group. The team should be trained on the response activities that are involved in ensuring the security of the group. Key among them is staging fire drills. The internal exercises will be essential in determining the holes that can be the entry of the malware into the system. To save the cost of operating a team, the organization can hire an outside response team. It is much cheaper for the fact that the team will only have to deal with the actual security threats unlike the internal organization that has to deal with firewall management, changing user accounts and passwords, or reviewing log files. However, outsourcing the response team has its disadvantages for there is no effective and timely incidence response like in the case of the internal response team.

Recovery process
The disaster recovery process involves getting the files and programs that have been compromised back into use. The files and disks are loaded back into the servers for use again. In the policy, the recovery team should monitor the disks and the computers for at least twenty-four hours to ensure they are working properly before they are transferred to the end users in the organization.

Continuity plan
A business continuity plan is drawn from the follow-up made on the incident. There should be scrutiny of the instruction and detection of the incidences. There should be a recording keeping on the actions put in place and the outcomes. The information and the outcome will be useful in deterring further occurrences similar to the one that occurred in the process. The actions will be useful in preventing a similar incidence and even strategizing (Preda, Christodorescu, Jha, & Debray, 2008).

Conclusion
Net down can be compromising to the organization.