Category Archives: Incident Response

Types of Threat – Explained

From a high level what are the types or categories of threats faced by the Security professional? Let’s go over some basics. Internal Authorised Internal Unauthorised Internal to External External to Internal External to External (new) The first 4 are … Continue reading

Posted in Cyber, Forensic Readiness Plan, Incident Response, Preparation | Tagged , , , , , , | Leave a comment

Pass-the-hash Mitigation – Tip of the Day

I have been recently researching Pass the Hash mitigation techniques and I have found that there are the usual comments about not logging on to workstations with Admin accounts, ensuring your local admin accounts don’t have the same password, ensuring … Continue reading

Posted in Group Policy, Hardening, Incident Response, pass the hash, Pen Testing, Preparation, Research | Tagged , , , , , | Leave a comment

Renaming a GRR Server & Client Configuration

Renaming the Server & Updating the Clients Rather than rebuilding a new server for every deployment you may feel it is easier to build a clean virtual build and clone that for each customer. As such renaming the VM would … Continue reading

Posted in Google Rapid Response, GRR, Incident Response | Tagged , , , | Leave a comment

Incident Response Process Phase 3 – Containment

First Steps When moving into the containment phase an incident has already been declared. It is now time to categorise the incident and relay this to the customer/management. The categorisation or characterisation of the incident can be broken down into … Continue reading

Posted in Containment, Incident Response | Tagged , , , | Leave a comment

Incident Response Process Phase 2 – Identification

Identification I was going to do another section on Preparation, but I realised I could continue with that until the end of days. So lets move on to Identification How does the Identification phase start? There are a multitude of … Continue reading

Posted in Cyber, Identification, Incident Response | Tagged , , , | Leave a comment

Incident Response Process Phase 1 – Preparation

This phase is open-ended, you will always be tweaking and fiddling policies and technologies to make the environment as secure as you can. Just as you think it’s fixed, a zero day comes along and ruins your picnic. So what … Continue reading

Posted in Incident Response, Preparation | Tagged , , , | Leave a comment

Incident Response Process

Today I am going to discuss the basics of an Incident Response process. I did not create this, I would love to give credit to those who did! There are other variations out there, however they all follow the basic … Continue reading

Posted in Incident Response, Introduction | Tagged , , | Leave a comment