Abstract
When computer security incidents occur, it is critical for organizations to have an effective means of responding. The speed with which organizations can recognize, analyze, and respond to incidents will limit the damage done and lower the recovery cost. This presentation discusses best practices in building such incident-response capabilities.