When something goes wrong

Even good defences fail sometimes. What separates a small problem from a disaster is how you respond. Security teams follow a simple plan:

1. Detect: notice something is wrong (often from the logs).
2. Contain: stop it spreading. Disconnect the affected device, lock the account.
3. Eradicate: remove the cause, the malware or the stolen access.
4. Recover: restore from clean backups and watch closely.
5. Learn: write down what happened and fix the weakness so it cannot happen again.

The calmest teams are the ones who decided these steps before an incident, not during one.

Practice

Imagine a staff laptop is infected with ransomware. Write the first two actions you would take, in order. (Hint: which step stops it spreading to other machines?)