Summary

Incident response teams put a great deal of effort into preparing for and executing the tasks necessary to properly handle an incident. Of equal importance is properly documenting the incident so that decision makers and the incident response team itself have a clear understanding of the actions taken and how the incident occurred. It is through the use of this documentation and analyzing a root cause that organizations can improve their security and reduce the risk of similar events in the future. One area of major concern to incident responders and forensic analysts is the role that malware plays in incidents. The next chapter will discuss some of the techniques available to analysts in addressing these types of incidents