The Contractor’s Report

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 15 of 20.

Challenge

Medium

Ticket from Sam, IT lead

A contractor installed a new colour profile on studio-laptop. Investigate its outside connection and save evidence while the responsible program is running. Remove that program’s current activity and its ability to launch again before customer data leaves. Keep the approved backup and checkout working.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe ProgramThe Contractor’s Report