Cyber Hygiene: Enhanced Incident Response
Enhanced Incident Response
In theory, the incident response (IR) process is straight forward. In reality, what happens when a threat becomes a reality is much different. Are you following your IR plan, which dictates steps taken based on a given scenario? Is investigation of how the incident originated part of your IR flow, or is it an afterthought for post-incident work? Are you collecting useful artifacts to help prevent and/or detect similar threats in the future? How about enhancing protective measures to prevent these incidents from occurring in the first place? While there is a lot more to incident response than re-imaging a PC, many organizations still only go that far to getting their operation back on track.
In this session, we will take a look at IR flow, from preparation to post-incident work. By the end, we will see how effectively one can perform containment, extract artifacts for analysis and evidence, and get systems back to a recovered state. Also, we’ll walk through stopping future incidents in their tracks by using artifacts discovered in the response process. When all is said and done, we’ll have an IR process that, using a single platform, will provide measures for preventing incidents in the first place, but also make IR a lot more effective than the “nuke and pave” technique, without taking a lot more time.
Steve Bowers - Cybersecurity Consultant
Steve is a cybersecurity professional with a passion for educating others. Through various roles over the past 11 years, Steve has had the opportunity to learn some valuable lessons in the development of cybersecurity programs. Steve has seen several common issues in the multitude of roles and organizations within which he has worked, and aspires to help organizations use existing people, processes, or tools to alleviate these issues. Through
education, services rendered, or beer-fueled conversations, Steve aims to help others improve their day-to-day security operations and better manage risk.
