I had a lot of people see EH's posts on IH as well as a few on my site and i wanted to put together a coherent list of links for IH/IR. Whether you are just starting a IR team, or are looking to refine your methods, there should be a few items for everyone. This is not all my information, some of it was gathered by me, some by gracious forum members. I will continually update it if you guys would like to add something! Please, please, please help me add to this =)

Level I - Incident Response / Incident Handling

These are very good top level (they don't stay that way for long) documents describing IH/IR.

NIST SP 800-61: Computer Security Incident Handling Guide (148 pages)

SANS 6-Step Process

Computer and Network Security Task Force IR/IH page

Carnegie Mellon's Handbook for CSIRTs (creation and roles for a IR/IH Team)

Level II - Specifics

SANS offers a lot to the security community, so there it is really no surprise that their reading room and their instructors offer some of the best resources around.

SANS InfoSec Reading Room - Incident Handling

Initial Security Incident Questionnaire for Responders

Security Incident Survey Cheat Sheet for Server Administrators

Network DDoS Incident Response Cheat Sheet

Incident Reverse-Engineering Cheat Sheet

CERT Virtual Training related to IH/IR

tssci-security Web application security incident handling insights

SANS Intrusion Discovery Cheat Sheet: Linux

SANS Intrusion Discovery Cheat Sheet: Windows


Tools

MIR-ROR: Motile Incident Response – Respond Objectively, Remediate

This script outputs all useful IR windows commands, and some sysinternals Scripts into one place. Note it is meant to be used after you have taken the initial HD image. Great writeup on it here



Reporting

When it comes to Advanced Threats there is some argument on reporting, if you chose to The Internet Storm Center and Shadowserver Foundation are good places to start.

Certification

We all want ways to distinguish ourselves, right? Below are the ways to go for certification, albeit not always the cheapest options.

CERT®-Certified Computer Security Incident Handler

SANS/GIAC Certified Incident Handler


Resources

Incident Report Templates

Gideon T. Rasmussen's Incident Report Template
SANS Incident Identification Form
SANS Incident Survey Form
SANS Incident Containment Form
SANS Incident Eradication Form
SANS Incident Communication Log Form
Melissa Guenther's Incident Report Form
US-CERT Incident Reporting System

Great list


When writing IH procedures I have found NIST 800-61 to be tremendously useful. If you only had one resource this would be it.

I would recommend running through Appendix B-Incident Handling Scenarios. It is great for helping you work out any kinks you may have in your organization's IH procedure. It is also go to have a few trial runs at these situations so you are better able to handle them and think more clearly.

Jhaddix mate, this is awesome. thanks for taking time to put this together, very good information for people in field.

Under Resources the link to CERT/CC Incident Reporting Guidelines has been moved/removed.

Also, I think a good addition would be SANS cheat sheets by Ed Skoudis.  There is one for Windows (http://www.sans.org/resources/sec560/windows_command_line_sheet_v1.pdf), NetCat (http://www.sans.org/resources/sec560/netcat_cheat_sheet_v1.pdf), and Misc tools aka Metasploit, Meterpreter, fqdump, and hping. (http://www.sans.org/resources/sec560/misc_tools_sheet_v1.pdf).  Ed has mentioned a UNIX cheat sheet, but I yet to find it.

Nice to see this is a "living document".

When will you ever have time between world class interviewing, article writing, and your normal work?

Excellent list!  Here a couple of tools you may or may not want to add.  Both of these are free tools to mount a drive image as a new drive to your system and assign them a driver letter.  I use both of them.

1. Paraben P2eXplorer  This one is a little odd because, even though it's free, they still require you to enter a credit card number.  Other than that, it's great.  Oh, it doesn't work on a 64 bit system as I discovered.

2. IMDisk  Another excellent mounting utility.

KP