The helpful reboot
A worker sees a strange pop-up and the computer slows down. A keen colleague turns it off and on again, to be helpful.
The pop-up has gone, and so has the trace of what caused it. Your first minutes decide whether the proof survives.
By the end of this lesson
Note
I can take four safe steps when I find an incident, so the evidence is kept.
Key words
| Word | What it means |
|---|---|
| Isolate | to cut a device off from the network so the harm cannot spread |
| Network | computers joined together so they can share data |
| Log file | a file where a system writes what it did and when |
| Evidence | data that shows what happened |
| Fingerprint | a short code worked out from a file, also called a hash |
| Escalate | to pass an incident to someone with more power or skill |
| Read-only | a file that can be opened but not changed |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Four steps for the first responder
The first responder is the first person who deals with an incident. There are four things to do.
1. Record the date and time and a description of what you saw.
2. Isolate the device from the network, if that is needed.
3. Copy the relevant log files.
4. Escalate to the right person.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.