Showing 1–12 of 26 articles
Page 1 of 3
What to put in an evidence pack for a lawyer
An evidence pack should let an authorized legal reviewer understand the sources, timeline, handling, and gaps. Ask counsel to direct legal scope and distribution while keeping the technical record clear.
Read the visual guide
Passwords that are still in Git history
Deleting a secret from the latest version does not invalidate it or remove every earlier copy. Contain the credential first, then assess repository history and any evidence of use.
Read the visual guide
Ransomware is a decision for leadership, not only for IT
A ransomware incident can force decisions about operations, disclosure, external support, and recovery priorities. Establish the authority and contact routes before the team is under pressure.
Read the visual guide
How to talk about an incident before you know everything
People can make better decisions when an incident update identifies facts, gaps, current actions, and the next communication point. Avoid letting a confident tone outrun the evidence.
Read the visual guide
Tabletop exercises that force a real decision
An exercise becomes useful when participants must make a real choice with limited information. Design the scenario around that choice, then capture what authority, evidence, and dependencies it exposes.
Read the visual guide
What to keep after a security incident
Useful evidence includes the original record, its source, the collection method, and the limits of what it shows. Keep investigation copies separate from originals and control access to both.
Read the visual guide
Why log times have to agree before you can trust the order
The order shown by two log systems may reflect clock settings, time zones, or ingestion delay rather than the true event sequence. Preserve those distinctions while building a timeline.
Read the visual guide
How to handle a security report from someone you do not know
A report from an unfamiliar person may identify a real issue. Provide a controlled route to receive it, assess the evidence, and decide the next step without encouraging unnecessary testing.
Read the visual guide
What to do when a password is pasted into chat
Deleting a chat message does not invalidate a password or token that someone may have copied. Identify the credential, revoke or rotate it, and review its possible use.
Read the visual guide
Questions to ask before you buy cyber insurance
An insurance policy needs to match your organization’s systems and likely losses. Resolve important definitions, exclusions, control requirements, and approved response arrangements before relying on cover.
Read the visual guide
How to run a short security exercise with eight people
A short exercise can reveal whether people know who decides, who contacts whom, and how recovery would begin. Use a realistic scenario and finish with a small, owned action list.
Read the visual guide
How staff should report a suspicious email
People report more effectively when the route is easy to find and the response is clear. Ask for the message and what happened after it, without encouraging further interaction.
Read the visual guide