Detect, respond, and recover
Prepare an incident plan
Decide roles, communication paths, evidence handling, containment options, and recovery priorities before a security incident occurs.
8 minute lesson
An incident is the worst time to decide who can shut down production. Prepare the first moves while the system is healthy.
Name the incident lead, technical contacts, decision authority, customer communication owner, and external providers. Keep current architecture, asset, secret, and backup information available. Rehearse one likely scenario.
A production database credential appears in a public build log at 02:00. The on-call developer can see it but does not know who may rotate it or whether rotation restarts the app.
A long policy is useless if the first responder cannot find the credential owner. The first-hour plan needs names, authority, commands, and a fallback contact.
Run a timed tabletop for the leaked database credential and record every decision and delay. Confirm the contacts answer, the revocation path exists, and the team can preserve the relevant logs.
Lesson completed