Summary
In this chapter, we discussed several topics related to how to respond to an adverse event. We covered quite a bit in regard to what information to capture, how to capture it, and when it should be captured. Not only do we need to capture all of the information regarding the incident but we must also protect it by using different types of encryption.
We learned that it is important to capture all the information necessary to walk through the steps again if we ever need to. This includes the people involved in the incident, the locations, and what occurred during that time. We also learned that we need to capture the metadata about the event as well. This includes the timestamps, IP addresses, usernames, and duration. We also need to require that the event in the log has a sequence number associated with it. This way, we know that logs are not missing.
We must protect the incident logs as well, as we learned in this chapter. This requires the use of encryption. We can...
