IR on computers
Most commonly, IR efforts in many organizations will involve computers. These are the most common attack landscapes in organizations. Attackers will target computer users, data stored on computers, systems running on computers, and so much more. There are so many readily available attack tools that can be used on computers. Estimates say that over 300 million new types of malware are produced yearly, and the number is still increasing.
Fortunately, there has been an intense focus on computer security and IR. Therefore, there are many existing defense and IR tools available for security teams to use. Many IT environments are multiplatform, and hence feature different operating systems. In most cases, servers might be on Windows and Linux, while end users will be on Windows or macOS. This broadens the scope that security teams have to cover. Therefore, this section will look briefly at IR on the major operating systems: Windows, macOS, and Linux. A mock incident...
