New answers tagged

0

This should be a given but as Anthony stated, you will want to contain the incident first and foremost. It wouldn't make much sense to try and collect evidence for a hack on a muti-million dollar company that trusts the security of it's information (client accounts, employee personal info, database files, etc) to you while an attacker was still free to do ...


1

In an security incident response situation, incident containment should come before evidence preservation. To give you an example, imagine a hack at your company. You would want to limit the ability of the hacker to compromise your company's system any more than he already did. Only after the incident has been contained, would evidence preservation come ...


4

Short answer: Both. Longer answer follows. Incident response actually starts before either of these two cases. A mature incident response plan has specific classifications on what qualifies as an incident, and that can vary from organization to organization, but there is a second term, event. Before it is confirmed that malware is spreading on the network ...



Top 50 recent answers are included