Summary

This chapter explained the post-incident phase in the cybersecurity IR process. The key takeaways will help to guide the organization’s management to understand the various steps required to successfully close the case, save the reputation, and gain an advantage in the situation.

We have covered the foundation, which is cybersecurity gaps identification, leading to efficient recommendations development. The breakdown into three or four domains strongly supports budgeting and planning investments in cybersecurity, powered up by proper lessons learned and follow-up, which increases the cost of an incident and/or breach. For sure, this will never be a party-stopper for nation-sponsored groups but will definitely enhance the detection and response capabilities against this type of sophisticated intrusion.

Strong standing in fighting against cybercrime will always positively impact the positions of organizations, attracting more and more clients and raising trust and...