Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.

Having a computer security incident response capability means that an organization is prepared to detect and counter computer security incidents in a skilled and efficient manner. Such a capability is a combination of technically skilled people, policies, and techniques with the aim of constituting a proactive approach to handling computer security incidents. Having an incident response capability with traditional computer security elements can provide organization-wide protection from damaging incidents, saving the organization valuable resources and permitting it to take better advantage of the latest computer technology. Many businesses, organizations, and government agencies have implemented incident response capabilities with great success, generally focusing on the following areas:

Efficient response. Efficiency is one of the most important aspects of a computer security incident response capability. Without an efficient capability, incident response is disorganized and ineffective, with the organization maintaining higher expenses and leaving vulnerabilities open and unprotected. For example, uneducated responses to small outbreaks of computer viruses can actually make their effects far worse, resulting in hundreds of computers being infected by the response team itself. A proper computer security incident response capability helps in the management of incident response expenses that are otherwise difficult to track, makes risk assessment more accurate, and improves user training and awareness with regard to computer security. Conversely, an inefficient incident response effort can perpetuate existing problems and even exacerbate them.

Centralization. A security incident response capability must utilize centralized means for reporting and handling incidents. While this undoubtedly increases efficiency, it also permits a more accurate assessment of the incidents, such as whether they are related (in order to more quickly avert possible widespread damage). By virtue of centralization, incident response capability expenses and overhead can be kept down, and duplication of effort can be reduced (possibly eliminated entirely). Organizations may find a significant cost savings as a result.

Improved user awareness. The benefits of an incident response capability include enhanced user awareness of threats and knowledge of appropriate controls. An incident response capability will help an organization identify vulnerabilities and issue computer security alerts. Information regarding security awareness can be disseminated throughout the organization by using a variety of mechanisms such as a company intranet, seminars, and training workshops. Such information greatly improves the users’ ability to manage their systems efficiently and securely