📊 We use cookies & analytics to improve your experience. Learn more
Latest

Cybersecurity Fundamentals Module 5 · Lesson 13 of 15

0% Exit to course

Module 5 · Responding, and getting hired Lesson 13 of 15

Incident response basics

Learning objective

An incident is handled in a known order: prepare, detect, contain, eradicate, recover, learn. Skipping contain to go straight to the fix is how an attacker gets a second chance.

The concept

A checklist written in calm times is what keeps a 2am response ordered; the goal in the first hour is to stop the spread and preserve evidence, not to fully understand the cause.

The lesson comes at the end and changes something real - a rule, a training, a monitor. An incident review that produces no change is a story, not a response.

Plain text
IR order:  Prepare -> Detect -> Contain -> Eradicate -> Recover -> Learn

Suspected phished account - first hour:
  1. Contain   reset the password, revoke sessions, enable MFA
  2. Preserve  export the mailbox rules and the login log
  3. Eradicate check for forwarding rules and new OAuth apps
  4. Recover   restore access, watch logins for a week
  5. Learn     add an alert for new mailbox rules

Worked example

On a suspected compromise, isolate the machine from the network first - contain - then investigate, rather than pulling the power and losing the evidence in memory.

Your practice task

Write a one-page incident checklist for a suspected phished account: who to call, what to isolate, what to preserve.

Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.

Key takeaway

A checklist written in calm times is what keeps a 2am response ordered; the goal in the first hour is to stop the spread and preserve evidence, not to fully understand the cause.

Create free account or sign in

Almost there

15 lessons left of 15

Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.