Episode 5 - NIST SP 800-61 Computer Security Incident Handling Guide (Post-Incident Activity)

TLP - The Digital Forensics Podcast

Innehåll tillhandahållet av Clint Marsden. Allt poddinnehåll inklusive avsnitt, grafik och podcastbeskrivningar laddas upp och tillhandahålls direkt av Clint Marsden eller deras podcastplattformspartner. Om du tror att någon använder ditt upphovsrättsskyddade verk utan din tillåtelse kan du följa processen som beskrivs här https://sv.player.fm/legal.

5M ago 33:06

MP3•Episod hem

Send us a text

This is the biggest episode from a content perspective so far. I'm excited to share it with you.
Episode Highlights:

How to run post-incident debriefs and post-mortems.
Involving external teams
Using lessons learned to form actionable insights.
Key questions to address in incident analysis.
Effective report writing strategies, including timelines and executive summaries.
Evaluating and improving incident response procedures and tools preparation.
Engaging broader teams in the debrief process for better cooperation.
Tracking and documenting incident response efforts for continuous improvement.

Key Takeaways:

Post-incident debriefs and post-mortems afford the most value for learning, improving incident response and preventing reoccurance.
Using structured frameworks and guidelines, like NIST 800-61, provide valuable direction for how to run your debrief and post-mortem meeting.
Effective communication, documentation, and cooperation across teams enhance incident handling and future preparedness.

16 episoder

#Tech #Clint Marsden #DFIR #Incident Response #Forensic #Cyber #Windows #Hacking #Blue Teaming #Red Team #Auscert