Summary

Benjamin Franklin is quoted as saying: “By failing to prepare, you are preparing to fail.” In many ways, this sentiment is quite accurate when it comes to organizations and the threat of cyber attacks. Preparing for a cyber attack is a critical function that must be taken as seriously as any other aspect of cybersecurity. Having a solid understanding of the IR process to build on this with an IR capability can provide organizations with a measure of preparation so that in the event of an incident, they can respond. Keep in mind as we move forward that forensic techniques, TI, and reverse engineering are there to assist an organization to get to the end—that is, back up and running.

This chapter explored some of the preparation that goes into building an IR capability. Selecting a team, creating a plan, and building playbooks and escalation procedures allow a CSIRT to effectively address an incident. The CSIRT and associated plans give structure to the digital forensic techniques to be discussed.

This discussion begins with the next chapter, where proper evidence handling and documentation is the critical first step in investigating an incident.