Chapter 3: Basics of the Incident Response and Triage Procedures
When responding to a cybersecurity incident, there are three essentials to consider:
- Response time
- Following appropriate procedures depending on the type of incident
- Using the right tools
Every incident is unique and has very particular challenges...
We reviewed some cases in the first chapter where attackers used deception to make the response and investigations more difficult. For example, in the cyberattack against Banco de Chile, the attackers used the distraction to compromise around 9,000 devices using the KillMBR malware. The threat actors' real objective was to transfer money to another country, abusing the SWIFT money transfer system, to avoid the security staff figuring out what was happening.
An incident response...
