Incident documentation
In the introduction to this chapter, we already discussed the pivotal role of this stage in the cybersecurity IR process. So far, we have defined missing items of meaningful reporting, such as cybersecurity gaps and recommendations. Now, let’s delve into the types of documents that need to be prepared, their purposes, and how to avoid potential issues in the future. The following points provide a brief overview, while examples of report structures and best practices for writing them will be discussed later in this chapter:
- IR technical summary report: This report should comprehensively describe the kill chain of the attack (any convenient methodology can be used), establish logical connections between all attacker actions, illustrate which infrastructure was compromised, and detail the extent of the damage inflicted. In addition to describing the attack and attribution of the attacking group (if possible), the report should include the attack timeline...
