{
  "docId": "019dd923-5de0-76bd-a166-0ebac6399c4f",
  "docSlug": "994e80d75408a4b6",
  "documentTitle": "INCIDENT RESPONSE INSIGHTS",
  "authorId": "misc",
  "authorName": "Booz Allen",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 7,
  "pageCount": 10,
  "prevPage": 6,
  "nextPage": 8,
  "slideType": "initiative_list",
  "function": "present_solution",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "Part of a series; continues from a previous slide covering controls #1-5.",
  "elementsJson": [
    "bullet_list"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/7",
  "deckHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f",
  "deckJsonHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json",
  "deckAnchorHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-7",
  "components": [
    {
      "bbox": {
        "h": 0.35,
        "w": 0.35,
        "x": 0.2,
        "y": 0.6
      },
      "kind": "list",
      "text": "7) Event Logging: Recommends SIEM solutions, proper log preservation, and recording detailed session information.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "0bf0c73f-acc7-41b3-a02e-c7f5d37d86bb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.35,
        "w": 0.35,
        "x": 0.2,
        "y": 0.08
      },
      "kind": "list",
      "text": "6) Password and End-User Account Management: Emphasizes active user management, strong password policies, and group privilege control.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "84dac8ba-b861-430b-b173-c0d5862503c9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.35,
        "w": 0.35,
        "x": 0.6,
        "y": 0.5
      },
      "kind": "list",
      "text": "8) Backups: Advises on both onsite and offsite storage to protect against encryption or deletion by threat actors.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "da18b93b-e801-401d-bb59-bad8f09febea",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.15,
        "x": 0.02,
        "y": 0.18
      },
      "kind": "paragraph",
      "text": "IR Update Summary: Read on for a summary of our Incident Response team's recent observations alongside insights from across the cybersecurity community.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "648864e9-451d-43ca-befb-24fd03fe59c6",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.4,
        "x": 0.2,
        "y": 0.03
      },
      "kind": "title",
      "text": "Underwriting Focus Area – Top 10 Security Controls - #6 to #10",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "f4ef8f58-addd-49bc-bfcb-bbda6abf61ff",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 8,
      "from": 5,
      "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640",
      "arcName": "The Sparkline",
      "arcSlug": "sparkline",
      "beatName": "Detailed Analysis",
      "beatSlug": "sparkline-what-is-3",
      "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls",
      "position": 1,
      "confidence": 0.8,
      "parentBeatName": "Complication",
      "parentBeatSlug": "complication"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}