SGC Job Analysis Questionnaire - R2G17 - Incident Response

 

 

You have completed 0% of this survey
0%
100%

For the role of Incident Response in the Smartgrid Cybersecurity environment, please indicate how frequently each task below would be performed by a person at the listed level of expertise, and how important is it that this task be completed by a person with the listed level of expertise.
*Maintain a security configuration/coverage map of tools used across the enterprise (Task ID: R2-9341)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Analyze monitoring solution to determine if newer technology better accomplishes the mission (Task ID: R2-9173)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Analyze which systems are being regularly scanned and which systems are being missed (Task ID: R2-9278)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Assign significance to custom SIEM rules for unknown event types (Task ID: R2-9433)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Configure alert rules for SIEM solution to automate alerts. (Task ID: R2-9352)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Configure assets IP address and pertinent meta-data (Task ID: R2-9255)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Configure rules for SIEM tools to capture and flag events known to be intrusion indicators. (Task ID: R2-9105)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Configure SIEM rules and alerts for unsupported devices such as those used in the Smart Grid and AMI. (Task ID: R2-9131)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Configure system technical policies that set thresholds and parameters for monitoring. (Task ID: R2-9156)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Develop custom SIEM parsers for unknown event types (Task ID: R2-9432)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Establish a test lab where tools can be practiced and learned. (Task ID: R2-9345)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Maintain an asset inventory of both hardware and software. Link this inventory to other security tools. (Task ID: R2-9593)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Review healthy log collection metrics to understand baseline from which to measure normal performance. (Task ID: R2-9431)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master) 		 
*Review SLAs/OLAs to understand expected thresholds. (Task ID: R2-9429)
  Frequency   Importance
  Never Rarely Sometimes Often Always   Unimportant Low Moderately Very Extremely
Novice (Apprentice)  
Intermediate (Journeyman)  
Expert
(Master)