Tips

• Every time an incident approaches closure, you should not only document each step that was performed during the investigation, but also make sure that you identify key aspects of the investigation that need to be reviewed to either be improved or fixed if they didn't work so well.
• The best incident handling plan is one that can be formalized.
• Regularly test and evaluate your IR plan. It's crucial that you analyze what did and didn't go well with the existing plan. To check your IR plan, you can start with a paper test, tabletop exercises, and simulated attacks.
• To have successful incident handling, you need to build an incident handling plan with proper regulatory policies (such as NIST, as covered in this chapter).
• Periodic training programs and post-incident analysis are essential elements of incident handling.