Documentation of security incidents with an incident handler's journal
One if the documentations contained in my incident handlers journal is a security incident involving a ransomware attack on a small U.S. healthcare clinic which severely disrupted their business operations.
The cause of the security incident was a phishing email that contained a malicious attachment. Once it was downloaded, ransomware was deployed encrypting the organization's computer files.
An organized group of unethical hackers left a ransom note stating that the company's files were encrypted and demanded money in exchange for the decryption key.
I used the incident handler's journal to document this incident as well as others using the following format as a guideline:
- The journal entry date and number
- A description of the journal entry
Answers to the following questions about the incident such as:
- Who caused the incident?
- What happened?
- When did the incident occur?
- Where did the incident happen?
- Why did the incident happen?
And my final thoughts or questions about the incident.
