Lesson 8: Incident Response, Business Continuity, and Disaster Recovery

A security event becomes an incident when it threatens confidentiality, integrity, availability, or normal operations and requires response.

Examples:

• malware infection,
• unauthorized account use,
• lost laptop with sensitive files,
• website defacement,
• insider misuse,
• ransomware,
• major data leak,
• denial-of-service disruption.

Not every unusual event is a confirmed breach, but suspicious events must still be assessed. Good security operations depend on recognizing and escalating incidents quickly.

An introductory incident response flow often includes:

1. Preparation — policies, roles, tools, contacts, backups, training
2. Identification — determine whether an incident is occurring
3. Containment — limit spread and damage
4. Eradication — remove the cause
5. Recovery — restore normal service safely
6. Lessons learned — improve after the incident

A practical example:

• suspicious endpoint behavior is detected,
• IT confirms malware,
• affected host is isolated,
• malicious files are removed,
• system is restored from a clean state,
• controls are improved to prevent recurrence.