The path from UK Armed Forces communications work to cyber security runs through the same question: can this system be trusted?
Mark Hayward began in Communications and Information Technology in the UK Armed Forces. He later delivered cyber security services to local and central UK government departments.
That background helps explain why I keep coming back to Incident Response. When something goes wrong, the order of work matters. Detection tells you there is a problem. Containment limits it. Recovery gets systems working again. A post-incident review helps you understand what happened.
I see people jump straight to recovery when they talk about an incident. I understand the urge. But without a clear account of what was detected and contained, it is harder to know what you are recovering from.
Our Incident Response book covers the process from detection through lessons learned. Keep that whole sequence in view before an incident forces the pace.