Post-incident response

- [Instructor] So after the incident response team…has conducted their assessment, performed their actions,…and worked with the system administrators…to correct the incident,…the organization is still not fully done…with this incident.…Instead, there are three more things…that have to be completed.…The root cause analysis,…the lessons learned process,…and the after-action report.…The root cause analysis is a systematic process…to identify the initial source of the incident…and how to prevent it from occurring again.…This analysis usually occurs using a four-step process.…

First, you define and scope the incident.…Second, you determine the causal relationships…that led to the incident.…Third, you identify an effective solution.…And fourth, you implement and track the solutions…to ensure the incident is fully resolved.…So, let's consider the example…of a malware infection in your organization.…First, you'd want to determine the initial cause…of the incident.…Maybe it was caused by malware being introduced…to your network by a user plugging in a thumb drive…