Priya has detected the intruder — now she has to evict them and put Meridian back together without destroying the evidence of what happened. This chapter runs the full incident: the response lifecycle, the forensics that reconstruct the attack, the ransomware case, and the review that turns the breach into a stronger program.
5 topics
Detection is only half the answer to "assume breach"; the other half is what you do when the alarm is real. This chapter runs the incident from confirmation to closure: the disciplined lifecycle that keeps a response from becoming a scramble, the forensics that reconstruct exactly what happened without destroying the evidence, the special case of ransomware, and the blameless review that feeds every lesson back into the program.
Five topics: the incident-response lifecycle, digital forensics basics, containment and eradication and recovery, ransomware response, and the post-incident review. The recurring tension is speed against completeness — contain fast enough to stop the damage, thoroughly enough to actually evict the attacker, and carefully enough to keep the evidence intact.
The incident lifecycle — and preparation decides all of it