Incident Response

Immediate Actions (0-1 Hour)

1. Isolate Affected Systems

# Disable affected endpoints
systemctl stop ai-service

# Review recent logs
tail -n 1000 /var/log/ai-service.log | grep -i "suspicious"

2. Identify Compromised Data

• Review audit logs
• Check for data exfiltration
• Identify affected users
• Document timeline

3. Activate Response Team

• Incident Commander
• Technical Lead
• Security Analyst
• Legal Counsel

Short-Term (1-24 Hours)

Patch Vulnerabilities

// Update input validation
func enhancedSanitize(_ input: String) -> String {
    // Add new patterns
    // Strengthen validation
    // Update threat detection
}

Reset Credentials

• Rotate API keys
• Update system prompts
• Reset user sessions
• Invalidate tokens

Notify Affected Users

Subject: Security Incident Notification

We detected a security incident affecting [scope].

Actions taken:
- Immediate system isolation
- Vulnerability patched
- Enhanced monitoring

Your data: [Impact assessment]

Contact: security@company.com

Recovery (24+ Hours)

Post-Incident Review

□ Root cause identified
□ Vulnerabilities patched
□ Monitoring enhanced
□ Team debriefed
□ Procedures updated
□ Training scheduled

Next Module: Best Practices →