Chapter Eleven · Evicting the Intruder

Incident Response and Forensics

Priya has detected the intruder — now she has to evict them and put Meridian back together without destroying the evidence of what happened. This chapter runs the full incident: the response lifecycle, the forensics that reconstruct the attack, the ransomware case, and the review that turns the breach into a stronger program.

5 topics

Detection is only half the answer to "assume breach"; the other half is what you do when the alarm is real. This chapter runs the incident from confirmation to closure: the disciplined lifecycle that keeps a response from becoming a scramble, the forensics that reconstruct exactly what happened without destroying the evidence, the special case of ransomware, and the blameless review that feeds every lesson back into the program.

Five topics: the incident-response lifecycle, digital forensics basics, containment and eradication and recovery, ransomware response, and the post-incident review. The recurring tension is speed against completeness — contain fast enough to stop the damage, thoroughly enough to actually evict the attacker, and carefully enough to keep the evidence intact.

The incident lifecycle — and preparation decides all of it
1
Prepare
plan · roles · tooling
2
Identify & scope
confirm · classify · scope
3
Contain · eradicate · recover
stop · remove · restore
4
Learn
blameless review

Topics in This Chapter