How Large Should Your IR Team Be And Should They Be Dedicated Resources? presented at RSAeu 2013

by Dave Baumgartner,

Summary : Many customers we work with have a hard time understanding how large (or small) their Incident Response team should be. Which functions should be included? Do the resources need to be dedicated or can they be loaned from another team within InfoSec or across IT? Let's explore some common approaches together and discuss the pros and cons of a few typical approaches to staffing the IR function.
- See more at: http://www.rsaconference.com/events/eu13/agenda/sessions/649/how-large-should-your-ir-team-be-and-should-they-be#sthash.45MbRCJq.dpuf