-
Incident Response
Take back control
Containment
Investigation
Eradication
Recovery
1. Containment
- Limit the scope and impact of the attack
- Protect and keep available critical assets
- Access controls review
2. Investigation
- Assets Analysis
- Log Analysis
- Malware Analysis
3. Eradication
- Find Indicators of Compromise (IoC)
- Scan Infrastructure for IoC
- Remove Malware
4. Recovery
- Restore Services and Operations
- Incident Report
- Recommendations to improve the cybersecurity posture
