When Something Goes Wrong: Incident Response
Even good defences get breached, so prepare. A calm, ordered response limits the damage. The widely used phases:
- Prepare: know who to call, keep contact lists and backups ready.
- Detect and report: notice the problem (an alert, an odd login) and tell the right person quickly.
- Contain: stop it spreading (disconnect the machine, disable the account, change passwords).
- Eradicate: remove the cause (malware, the vulnerable software, the stolen access).
- Recover: restore from clean backups and watch closely.
- Learn: write down what happened and fix the root cause so it does not repeat.
Do not delete evidence, and do not panic-wipe: you may need the logs to understand what happened.
Examplepython
Quick check
An account looks hacked. What is the first priority after detecting it?
Your turn: write the code
Print the phase that comes right before 'Recover' in the list.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.