If you are a security professional, you know this day is coming. The day the security is breached. And you think you have all the relevant processes and procedures in place. Let’s zoom out a little bit. According to NIST, a security incident has five distinct phases: identification, containment, eradication, recovery, and post-mortem. However, when there is an incident, most security teams often jump straight to the eradication phase and skip the phases of identification and containment. When you ask why they do it, according to them it makes sense. The house is on fire, so the fire must be extinguished. But how can you kill a fire if you don’t know what you are dealing with?
