-
Book Overview & Buying
-
Table Of Contents
Cybersecurity – Attack and Defense Strategies - Second Edition
By :
The incident priority may dictate the containment strategy—for example, if you are dealing with a DDoS attack that was opened as a high-priority incident, the containment strategy must be treated with the same level of criticality. It is rare that the situations where the incident is opened as high severity are prescribed medium-priority containment measures, unless the issue was somehow resolved in between phases.
Let's use the WannaCry outbreak as a real-world example, using the fictitious company Diogenes & Ozkaya Inc. to demonstrate the end-to-end incident response process.
On May 12, 2017, some users called the help desk saying that they were receiving the following screen:

Figure 5: A screen from the WannaCry outbreak
After an initial assessment and confirmation of the issue (detection phase), the security team was engaged and an incident was created. Since many systems were experiencing the same issue...
Change the font size
Change margin width
Change background colour