Cyber-200

Recovery: How the incident was contained and eradicated

 The work performed during recovery

 Areas where the incident response team was effective

 Areas that need improvement

o Which security controls failed (including monitoring tools)?

o How can we improve those controls?

o How can we improve the security awareness programs?

o What were the current operating system vulnerabilities that were leveraged to execute the attack?

o How can managing patches and basic operating system security enhance security from known threats?