Respond to Angles discussion post:

Hello everyone,

The incident I have came across is when four lawyers Of Elliot Greenleaf Law firm stole organization files and deleted emails. They stole these files for personal gain to help Armstrong Teasdale and his competing law firm. All of the data that was breached were client data, intellectual property and other sensitive.

Step 1: Identifying and assessing the incident

First step is to identify and assess the incident, this is used to evaluate the intensity of the breach and see what the incident is based on. It is important to know when the incident happened to respond and mitigate any other damages that was done.

Step 2: Contain the incident

When the incident is identified, the next step is to contain the impact and prevent it from happening while under investigation. This step focuses on isolating the systems that were affected by unauthorized access. The employees used a USB drive to download all the data without permission and deleted evidence so they won't get caught. Luckily, the company had backups and found the deleted emails.

Step 3: Investigating the incident

Investigating the incident will tell you the reason why it happened, and to make sure this will not happen again. During this time the company can implement rules, policies, physical security and monitor the database.

Step 4: Recovering and restoring

Recovery stage is about getting the files back and letting customers know what data was stolen to mitigate any more damage that has been done.

Step 5: Learning from the incident

After investigation and restoration is over, there has to room for improvement for the company. Improving the security and response plan can help get everything under control faster. There should be team meetings to make sure each employee understands the incident and what to do.