Windows Forensics and Incident Recovery

Chapter 2. How Incidents Occur

As long as computer systems and networks are designed, installed, managed, and operated by people, incidents will occur. Many security incidents are the result of the actions of an individual or group, so regardless of what happens, people will always be involved in an incident in one capacity or another.

What you do prior to an incident is as important as what you do after an incident occurs, perhaps even more so. Before we think about including security in our infrastructure design, it helps a great deal to understand just how incidents occur. That way, maybe we can plan the security of our network design a little better. Security professionals use words like “risk” and “threat” when addressing network security ...