Summary
This introductory chapter has explored the IR process and suggested how organizations should get started. We first defined IR and highlighted the definitions of an incident. We looked at the orchestrators of security incidents and discussed the emerging criminal service industry where cybercriminals can hire skilled hackers, rent hacking services, and buy sophisticated hacking tools to carry out a successful attack.
The chapter then covered the common factors in recently reported security incidents around the globe, including a lack of resources, laxity in implementing security solutions, misleading security assumptions, weak attack surfaces, complexity in managing security, and failure to learn from previous mistakes.
The chapter then looked at the importance of having effective IR plans in organizations. It also viewed the general standing of GDPR and NIS about the responsibility of carrying out IR as a means of complying with regulations. Lastly, the chapter concluded...
