Responding to incidents

An incident is any event that threatens systems or data, like a malware infection or a stolen account. Organizations follow a plan so they don't panic.

The incident response life cycle

1. Preparation: have a plan, contacts, and backups ready before anything happens.
2. Detection and analysis: notice something is wrong and figure out what happened.
3. Containment, eradication, and recovery: stop the spread, remove the threat, and restore systems safely.
4. Post-incident activity: learn lessons and improve.

Good habits

Write down what you see and when. Don't turn off or wipe a system without direction, because it can destroy evidence. Restore from clean backups.