Lesson 11: Responding to Incidents and Recovering From Attacks

At 09:00, an organisation’s important digital service suddenly stops working, but nobody yet knows whether a technical fault or an attacker is responsible. The safest response does not begin by labelling the event; it begins by understanding what may be threatened and coordinating decisions. This raises the central question: what makes an event a cyber security incident, and how is that different from an ordinary fault or a confirmed cyber attack?