IR in the cloud
Brian Svidergol – Incident response fundamentals
The way you handle IR starts before an incident. As you see in many of the public compromises, many companies don't realize that they've been compromised. IR is much different when you start 9 months after you were compromised compared to starting immediately afterward or during. Organizations should start by configuring a solid security foundation. A solid security foundation applies to all vendors, hardware, and software. It even applies in the cloud, where you have less control and visibility.
We can break down the areas of focus for building a solid security foundation. This is my breakdown, but you can find it done in various ways all over the internet:
- Endpoint security: When I say "endpoint" here, I mean any computing device on your network that you manage. This includes mobile devices, tablets, laptops, desktops, servers, and any other computing devices.
- Monitoring...
