Explain what is required immediately after an incident is reported or believed to be occurring. What forms of investigation take place once the immediate breach or hole is plugged?
How can IT workers find out what happened? What tools are available to them to investigate the issue and be sure it does not recur?