Beginner level · Module 5: Incident Response Basics · Lesson 3 of 3
Recovery, Lessons Learned and Project Completion
Recover safely, improve defences and complete the level project.
In this lesson you will
- Recover accounts and devices safely
- Complete and present the Security Check-Up
Key concepts
recoveryroot causeimprovementsincident plan
The lesson
Recovery means restoring accounts and data from trusted sources, then checking for anything the attacker changed.
Ask how it happened and what would have prevented it — a reused password, no MFA, an unpatched device — and fix that.
Finish the Security Check-Up: account inventory, device checklists, phishing sheet and incident plan, and present it to the group.
Step by step
- Write a recovery checklist.
- Identify the root cause in each scenario.
- Complete the project deliverables.
- Present the check-up.
Practice activity
Complete and present the Personal and Small-Office Security Check-Up.
Expected result: A complete project that meets the criteria and contains no secrets.
Check your understanding
-
Why look for the root cause after an incident?
Show answer
To fix the weakness so it does not happen again.
-
What should a simple incident plan contain?
Show answer
Signs to watch for, first steps, contacts and recovery steps.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.