Incident Response with Threat Intelligence

Chapter 3: Basics of the Incident Response and Triage Procedures

"There is nothing more deceptive than an obvious fact."

― Arthur Conan Doyle, The Boscombe Valley Mystery – a Sherlock Holmes Short Story

When responding to a cybersecurity incident, there are three essentials to consider:

• Response time
• Following appropriate procedures depending on the type of incident
• Using the right tools

Every incident is unique and has very particular challenges...

We reviewed some cases in the first chapter where attackers used deception to make the response and investigations more difficult. For example, in the cyberattack against Banco de Chile, the attackers used the distraction to compromise around 9,000 devices using the KillMBR malware. The threat ...