Many organizations (large and small) are starting to think more formally about incident response and how to properly deal with incidents. This series outlines our approach to cyber incident response.

It’s based on a core principle of “Divide and Conquer”, which breaks up big investigative questions (such as “is this computer compromised”) into smaller and smaller questions until you get to one that can be answered with simple data (such as “are there suspicious startup items”).

Intro to Incident Response Triage:

• Intro to Incident Response Triage (Part 1): Buyer’s Guide
• Intro to Incident Response Triage (Part 2): Analysis Categories
• Intro to Incident Response Triage (Part 3): User Enumeration
• Intro to Incident Response Triage (Part 4): User Logins
• Intro to Incident Response Triage (Part 5): User Activity
• Intro to Incident Response Triage (Part 6): Malware Persistence
• How to Detect Running Malware – Intro to Incident Response Triage (Part 7)
• How to Detect Malware Remnants – Intro to Incident Response Triage (Part 8)
• How to Detect System Configuration Changes – Intro to Incident Response Triage (Part 9)