Incident response

The six steps

1. Prepare

   • List of people to call, on paper
   • Backups tested and disconnected
   • Who decides to shut down a server

2. Identify

   • Note what was seen, delete nothing
   • List affected hosts, accounts and servers
   • Check whether personal data is involved

3. Contain

   • Isolate hosts rather than shutting them down
   • Disable compromised accounts
   • Protect the backups

4. Eradicate

   • Find the way in
   • Remove what the attacker left behind
   • Change the affected passwords

5. Recover

   • Restore from clean backups
   • Bring services back in stages
   • Monitor closely

6. Learn

   • Write the timeline
   • Fix what was missing
   • Update the plan