Incident Response

What is Incident Response?

Incident response is the process of identifying, containing, eradicating, and recovering from a security incident. It is a proactive and reactive measure taken to protect an organization’s information assets and infrastructure. The goal of incident response is to minimize the damage caused by an incident and to restore normal operations as quickly as possible.

An effective incident response plan can help organizations to quickly and effectively identify and contain security incidents, minimize the damage they cause, and get back to business as usual as quickly as possible.

Articles

Concepts

• Why do we do incident response?

• What role does incident handling play when a cyber attack occurs?

• What will I do as an Incident Responder?

Data Collection

In any incident response, data collection is a critical first step. This data can come from a variety of sources, including network and host-based intrusion detection systems, system and application logs, and even direct observation. The data collected during this phase can be used to determine the scope of the incident, identify the systems and data affected, and begin to piece together what happened.

• Agentless Log Collection Microsoft WEC and WEF

• Pros and Cons of Agent-based and Agentless Log Collection

Miscellaneous Articles

There are a number of articles that don’t fit into any specific category. These are known as miscellaneous articles.

• An Overview of a Data Breach, its Causes, Recovery, and Remediation Techniques

• Common methods an adversary may adopt to cover their tracks

Workflow

What is a workflow?

A workflow is a series of steps that are followed in order to complete an engagement. In penetration testing, a workflow is important in order to ensure that all steps are followed in order to complete the testing process. By following a workflow, penetration testers can ensure that they are thorough in their testing and that they do not miss any important steps.

The image below proposes a workflow you can use to learn incident response:

Articles:

• Pre-Incident Preparation: For a Smoother Incident Response Process

• A short introduction to writing incident response playbooks

• Cyber Incident Checklists

• What is an Incident Response Toolkit?