Each day seems to bring with it reports of yet another compromise. Whether it is a breach of a large retailer’s payment system, the exposure of customer credentials or a foreign organisation after trade secrets, it seems no business is safe. While a plethora of tools exist to help secure your networks and systems, if you can detect an attempted intrusion, do you know what to do next? Drawing upon a decade of experience in incident response and digital forensics and some (heavily redacted) case studies, Michael will examine different responses to a compromise, describe the common traits of an effective response and identify common areas for improvement.