Intro to Cyber Incident Response (Divide and Conquer Approach)


Many organizations (large and small) are starting to think more formally about incident response and how to properly deal with incidents. This series outlines our approach to cyber incident response.

It’s based on a core principle of “Divide and Conquer”, which breaks up big investigative questions (such as “is this computer compromised”) into smaller and smaller questions until you get to one that can be answered with simple data (such as “are there suspicious startup items”).

Intro to Incident Response Triage: