Incident Response on Multiple Platforms

In the previous chapters of this book, we have highlighted the importance of preparing effective Incident Response (IR) strategies to protect your organization's computer infrastructure. However, the affected device may not always be a traditional computer device. This chapter will explore how to handle an incident on a variety of different device types, so you can be flexible in your IR processes. IR efforts vary slightly across devices, operating system platforms, and complex environments in the IT infrastructure, such as those with lots of legacy devices and applications. Commonly, IR teams will respond to incidents propagated through the network or from within the local environment by internal users to affect computers and devices. Furthermore, there are times when incidents will be recorded in sensitive environments such as Active Directory (AD), which have to be responded to in a manner specific to the incident.

This chapter looks...