Incident Response — What to Do When a Breach Happens

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Incident Response — What to Do When a Breach Happens, no intimidation required
Apply this concept right away in real-world scenarios
Learn to avoid security risks for yourself and others

Let's think about it this way for a second

The basic steps of incident response: (1) Identify: figure out what happened (unusual login, encrypted files, missing data), (2) Contain: immediately isolate it to stop it spreading further (disconnect the affected device from the network), (3) Eradicate: remove the root cause (delete the malware, close the vulnerability), (4) Recover: restore from backup and bring services back online, (5) Lessons Learned: document what happened and put safeguards in place to prevent it from happening again.

Let's connect this to a real-world scenario

In a ransomware attack, the very first thing to do is disconnect the affected device from the network immediately (Contain) — to stop the ransomware from spreading further. Then try to restore from backup (Recover); paying the ransom shouldn't be your first option. After the incident, document how the attacker got in and update patches/policies to prevent a similar attack from happening again (Lessons Learned).

Remember the 5 steps: Identify → Contain → Eradicate → Recover → Lessons Learned
When an incident happens, do Contain first (prevent it from spreading)
Document Lessons Learned after the incident

Let's look at it together

text

Incident Response Steps
-------------------------
1. Identify         — ဘာဖြစ်နေလဲ သိရှိ
2. Contain          — ပျံ့ပွားမှုကို ရပ်တန့်
3. Eradicate        — root cause ဖယ်ရှား
4. Recover          — backup ကနေ restore
5. Lessons Learned  — document + ကာကွယ်ရေးတိုးမြှင့်

You should see

Be able to explain the 5 steps of incident response using a ransomware scenario.

Try it in 5 minutes

Write out a 5-step response plan for the scenario 'a company laptop has been hit by ransomware'.

A quick word of caution

Paying the ransom funds the attacker and comes with no guarantee you'll actually get your files back — prioritize restoring from backup, and treat ransom payment only as an absolute last resort.

Easy traps

Panicking and rebooting/investigating a device before containing it — the incident can keep spreading
Skipping the Lessons Learned step once an incident is over and assuming it's 'done' — without fixing the root cause, it can happen again

Now try it yourself

Write out a 5-step response plan for the scenario 'a company laptop has been hit by ransomware'.

You'll know it worked when: Be able to explain the 5 steps of incident response using a ransomware scenario.