The role of Incident Response in Cyber Security
Without being a pessimist, as I am at my core an optimist, it is not a matter of if you will be breached, but when. It is a reality that vendors face when they are deploying the latest security tool…
Tag dfir
Introduction to Digital Forensics: Preparing for the Unexpected with Volatility, Wireshark, Hayabusa and FTK Imager
Understanding Digital Forensics Digital forensics involves the recovery and investigation of material found in digital devices (Windows or Linux computers, smartphones and legacy mobile phones and now, even cars) often in relation to computer crime, cyber intrusions and insider threats.…
NIST 800-61 – Detection and categorisation of incidents based on impact and recoverability.
Detection: Recognizing the Signs of an Incident Detection is the first crucial step in handling security incidents. The effectiveness of detection largely depends on the tools and systems you have in place, such as Intrusion Detection Systems (IDS), Intrusion Prevention…
The Importance of Preparation in Cyber Incident Response
In DFIR, one of the worst situations is facing a cyber incident unprepared. Imagine the chaos (or don’t, as it’s a reminder of the last big incident) when you’re looking at the incident response playbook for the first time during…
Basic Digital Forensics Process
I’ve shared this on Linkedin just yesterday 22 April 2024, but here I can provide a little more context. Before doing this work, it helps if you’ve followed the NIST Computer Security Incident Handling guide (SP800-61) available from: If…