8.2.6. Lessons Learned

Try these first

1. 1.

   What is the purpose of a post-mortem in incident response?

   Hint

   Think about why we reflect on past experiences.

2. 2.

   Why is documentation important in incident response?

   Hint

   Consider how recording details can help in the future.

3. 3.

   What is the purpose of the 'Lessons Learned' phase in incident response?

   • To celebrate success
   • To analyze incidents for improvement
   • To assign blame

   Hint

   Think about the goals of analyzing data.

4. 4.

   True or False: Documenting strengths after an incident is unnecessary.

   • True
   • False

   Hint

   Consider whether recognizing positives can help improve processes.

5. 5.

   You are the Incident Response Manager for a company that experienced a cyber breach. Describe how you would approach the post-mortem analysis, ensuring both strengths and weaknesses are documented.

   Hint

   Consider including both qualitative and quantitative analyses in your approach.

6. 6.

   Explain the potential implications of neglecting the 'Lessons Learned' phase after a cyber incident.

   Hint

   Think about how learning from mistakes contributes to growth.