The Incident Report

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 42 of 43.

After an incident, other people need to understand what happened. An incident report explains the facts: when the attacker got in, how they got in, which accounts they used and what information they took.

For example, suppose the evidence shows that Lee reused a stolen password. The first successful sign-in was at 08:12:04, and the attacker copied supplier contacts. You would record those facts separately:

seclab answer first 08:12:04

You should see:

Recorded your answer to first.

seclab answer entry reused password

You should see:

Recorded your answer to entry.

seclab answer accounts lee

You should see:

Recorded your answer to accounts.

seclab answer loss supplier contacts

You should see:

Recorded your answer to loss.

Use the time the attacker first got in, which may be earlier than the alarm. For data loss, report what was actually taken. If you stopped a larger download before it happened, do not count that as information the attacker received.

Challenge

Easy

Ticket from Dana, CEO

Write down four findings for tonight's attack: the first successful outside sign-in time, how the attacker got in, both affected staff accounts, and the data actually copied out. Use the logs and laptop checks, including the second account found later. Keep the completed cleanup and recovery changes in place.

Try it yourself

Terminal