Pre-incident
OSU didn't have much of an incident response team
- Incident response was ad-hoc
- Response depended on who responded
- Had recently hired me part time
I started some minimal initiatives:
- Tracking incidents
- Logging (authentication, network traffic)
- Education/awareness meetings
Notes:
Awareness meetings really facilitated formation of a formal incident response team, by the way – generated lots of good will, spirit of cooperation, etc.