Free Workshop: Investigating Insider Threats — February 20-27

Intro to Cyber Incident Response Series

Learn Brian Carrier’s "Divide and Conquer" approach.

Upgrade your IR approach

Many organizations (large and small) are starting to think more formally about incident response and how to properly deal with incidents. This series outlines our approach to cyber incident response.

It’s based on a core principle of “Divide and Conquer”, which breaks up big investigative questions (such as “is this computer compromised”) into smaller and smaller questions until you get to one that can be answered with simple data (such as “are there suspicious startup items”).

Get Brian’s DFIR tips in your inbox