– Signs of an incident.
– Alerts [endpoint protection, network security monitoring, host monitoring, account creation, privilege escalation, other indicators of compromise, SIEM, security analytics, and user behavior analytics].
– Estimate the scope of the incident.
– Designate a person who will communicate the incident containment and recovery status to senior management.
– Build a timeline of the attack.
– Chain of custody.
– Detecting and reaching to insider threats.
– Determine the extent of the potential data loss.
– Signs of an incident.
– Alerts [endpoint protection, network security monitoring, host monitoring, account creation, privilege escalation, other indicators of compromise, SIEM, security analytics, and user behavior analytics].
– Estimate the scope of the incident.
– Designate a person who will communicate the incident containment and recovery status to senior management.
– Build a timeline of the attack.
– Chain of custody.
– Detecting and reaching to insider threats.
– Determine the extent of the potential data loss.
– Documentation strategies: video and audio.
– Containment and quarantine.
– Pull the network cable, switch and site.
– Identifying and isolating the trust model.
– Evaluating whether a backup is compromised.
– Total rebuild of the Operating System.
– Moving to a new architecture.
– Who makes the determination to return to production?
– Monitoring to system.
– Expect an increase in attacks.
– Espionage.
– Inappropriate use.
– Pre-built forms.
– Legal acceptability.
– Lessons learned meeting.
– Changes in process for the future.
