Guide: Incident Response and Disaster Recovery

Incident Response and Disaster Recovery are essential components in the field of cyber security. As a part of the CISSP Security and Privacy controls concept, they play a crucial role in minimizing and controlling the damage in case of a security breach or disaster and resuming usual operations as quickly as possible.

Incident Response
What is it?
Incident response is a structured approach to handle and manage the aftermath of a security breach or cyber attack, aka an 'incident'. The objective is to limit damage and reduce recovery time and costs.
How it works?
Incident response usually follows a six-step process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons learned.

Disaster Recovery
What is it?
Disaster recovery is the area of security planning that deals with protecting an organization from the effects of significant negative events. These 'disasters' can be natural, such as a tornado or flood, or can be human-made, like a cyberattack.
How it works?
The process stories involve a set of policies and procedures that focus on protecting an organization from the effects of a negative event, enabling the organization to maintain or quickly resume mission-critical functions.

Exam Tips: Answering Questions on Incident Response and Disaster Recovery
1. Understand the steps involved in incident response and disaster recovery.
2. The best answers usually involve a comprehensive, organized, and proactive approach.
3. For disaster recovery, know the difference between Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
4. Practical examples and real-life incident response and disaster recovery scenarios can help you to understand the concepts better and answer the questions efficiently.