Incident Response

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 38 of 43.

When an attacker gets into a company account, the first job is to stop them from doing more harm. Then you investigate, remove anything they left behind, and help staff get back to work safely. This process is called incident response.

An attacker can sometimes steal a browser session from a computer. The session is already signed in, so the attacker may not have to enter a password or pass MFA again. For example, suppose Lee reports that the outside session below is not his:

seclab sessions lee

You should see:

user  address       machine  since
lee   203.0.113.77  mail     2026-10-25 21:04:00

Disable Lee's account while you investigate. This stops new sign-ins and ends the sessions that are already open:

seclab disable lee

You should see:

Disabled lee. They can no longer log in.

Lee will not be able to work through this account while it is disabled. Keep the account record so you can investigate, and restore access once the problem has been dealt with.

Challenge

Easy

Ticket from Sam, IT lead

A new admin account alarm fired while we were moving systems. An attacker has already copied a small sample of orders and is preparing to copy the full customer list. Find the staff account they are using and disable it before more data leaves. Keep its record, my account and our approved backup service.

Try it yourself

Terminal

Incident Response

All lessons in Security Fundamentals