NIST SP 800-61
Even though information security professionals plan to effectively manage risk, incidents still occur. NIST SP 800-61 is the National Institute of Standards and Technology (NIST) special publication that gives guidelines for organizations on how to handle security incidents. Read section 2.2 on page 6 to learn more about the need for, and the benefits of, an incident response capability. Also read section 3 on pages 21-44 to learn how to appropriately handle information security incidents. Before you move on, make sure you can explain the four stages of the incident response process: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
Handling an Incident
4.3. Evidence Retention
Organizations should establish policy for how long evidence from an incident should be retained. Most
organizations choose to retain all evidence for months or years after the incident ends. The following
factors should be considered during the policy creation:
- Prosecution. If it is possible that the attacker will be prosecuted, evidence may need to be retained
until all legal actions have been completed. In some cases, this may take several years. Furthermore,
evidence that seems insignificant now may become more important in the future. For example, if an
attacker is able to use knowledge gathered in one attack to perform a more severe attack later,
evidence from the first attack may be key to explaining how the second attack was accomplished.
- Data Retention. Most organizations have data retention policies that state how long certain types of
data may be kept. For example, an organization may state that email messages should be retained for
only 180 days. If a disk image contains thousands of emails, the organization may not want the image
to be kept for more than 180 days unless it is absolutely necessary. As discussed in Section 3.4.2,
General Records Schedule (GRS) 24 specifies that incident handling records should be kept for
three years.
- Cost. Original hardware (e.g., hard drives, compromised systems) that is stored as evidence, as well as hard drives and removable media that are used to hold disk images, are generally individually inexpensive. However, if an organization stores many such components for years, the cost can be substantial. The organization also must retain functional computers that can use the stored hardware and media.