Security Incident and Response

So far, within the realm of cybersecurity defense, we’ve covered a lot of ground surrounding the setup and acquisition of data from various sources and studied how to transport it, organize it, store it, and evaluate it through various methods of analysis. Have you wondered while covering all of these topics what you might do if the data you are analyzing suggests that an actual cyber-attack is occurring or has occurred? After all, it doesn’t do much good going through all of this work to grab, study, and try to decipher the data if we have no plan of action when the data tells us something bad is happening!

When our defensive analysis suggests malicious activity is happening, we transform into a new realm of cybersecurity. We go from triaging alerts to a formal action known as incident response. Oftentimes, organizations will have dedicated workers who specialize in responding to incidents that are usually a career step up from entry...