Closing Scenario

Eventually, Paul made it into the office.

Susan had called back to advise him that the frequency of source address shifting, ports being used, and volume of traffic from the DDoS attack had all increased. As on$-$site incident manager, she had decided to disconnect the company from the Internet.

She had formally made the declaration that this was an incident and not just another event. She had pulled the plug.

Discussion Questions

What should be the next action taken by the response team?

What if the plans had left out the list of people to notify? Who should be informed of this action next, after Paul?

When the production network is taken off the Internet, how can essential online response still occur? List three ways that an organization can plan for redundant essential communications.

Ethical Decision Making

Assume that Susan had the authority to terminate the network connection but deferred making that tough call until Paul arrived an hour later so she could avoid being responsible for the disruption. Is that an ethical position to take?