When to Declare an Information Security Incident and How to Respond Once You Do

This discussion session will examine the incident response process and apply it to a sanitized version of an actual web server compromise that took place at a real university. After an initial overview of the incident response process, attendees will be presented with a series of clues and will discuss how to respond as the clues accumulate.