Large scale incident remediation: Lessons learned

Abstract

The remediation phase is the most important step in a successful incident response. Preparation often takes multiple months to make sure you know the attackers tools, tactics and procedures (TTPs) before you kick them out of the network. Sometimes, getting all the technical aspects right isn’t the most challenging task. Large corporations often fail to set the right priorities regarding internal processes and compliance issues. In this talk we break down our approach, as well as sharing lessons from the field and Best Practices.