The final step in this incident response and incident management
module is to review what we learned from this incident.
In other words, we conduct a post incident review and apply lessons learned.
When we review, we should look at what went well.
We certainly want to continue the things that went well,
but we also want to do a very truthful and a
self‑assessment of what could be improved.
We want to know who demonstrated competence and the appropriate demeanor.
Did people get angry and argue during the middle of the crisis?
Who were the ones that displayed leadership,
the ability to make good decisions, rational decisions, in the middle of chaos?
One of the things we'll sometimes do is we'll do a review right
following the incident when the emotions are still high,
everybody's still a little bit so you should say,
agitated, and that's often called a hot wash.
Let's hear, right now, what happened.
The next step is to do a cold wash,
to go back later and look at it in the cold light of dawn,
and now that people have had a chance to recover,
think about it, and sort of say, okay,
what do we think now that we've had a little more time to reflect on it?
Both are important because sometimes in the cold wash,
we can have lost some of the things that we knew about at the time.
But in a hot wash, we didn't use always the most rational thinking either.
The idea of lessons learned is to improve our preparation,
improve our plans, improve our teams,
make sure we have the right tools and training that are needed,
improve our prevention through things like enhanced
controls and improve our detection.
I remember talking with one company that had a major breach, and as they said,
the one thing that they learned was they weren't
even monitoring the right things.
They had monitored many things,
but they didn't monitor the things that would have told them about that breach.
And certainly, we have to look at whether or not our containment really worked.
Was it an effective response?
A lot of this comes down to awareness, letting people know what we can learn,
what they can do,
certainly making the whole situation alive for them as well and address the
lessons learned through our various awareness sessions.
One of the things is that we want everybody in the staff to be
a part of our security team and have a security culture so they
are conscious of the types of threats that are out there and
know what to watch for.
In summary,
every incident contains key learning points that
the organization can learn from.
We often say the problem is trying to extract those small little flakes of gold
from the mountain of rubble of the actual incident itself.
We want to improve our incident response so we're
better prepared for future incidents.