Incident Response Fundamentals
Big idea
Incidents happen. The difference between a small problem and a disaster is how you respond.
Simple incident response phases
- Prepare
- Detect
- Contain
- Eradicate
- Recover
- Learn (improve)
First steps (beginner-friendly)
When something suspicious happens:
- Write down what you know (facts)
- Preserve evidence (logs, timestamps, screenshots if appropriate)
- Limit spread (containment)
- Communicate using the right channels
Scenario (10 minutes)
A user reports repeated MFA prompts they did not initiate.
Answer:
- What is the most likely risk?
- What would you do in the first 15 minutes?
- What evidence would you collect?
- What would “containment” look like?