SHIELD S – Scope the Compromise What was compromised? Which environment, device, application, vendor, account? H – How It Happened CVE, misconfiguration, stolen credentials, 0-day, insider activity? I – Identify Adversary Actions What did they do after access? Data theft, persistence, lateral movement, disruption? E – Evaluate Business Impact Revenue, cost, brand, legal, customer impact. […]
