Incident response (IR) follows the same phases in the cloud as on premises, commonly described as preparation; detection and analysis; containment, eradication and recovery; and post-incident activity (lessons learned). What changes in the cloud are the tools and speed: you can isolate a server, snapshot its disk or revoke its credentials with one API call.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 4 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.