What is Digital Forensics Incident Response? | Security Expert Reacts to DFIR

Digital Forensics and Incident Response (DFIR) is the cybersecurity field that defines the process and the best practices to follow in order to deal with a cyber attack or a security breach. #DFIR includes the initial response and containment of the attack, but also the plan the cyber investigator follows to gather evidence and identify what happened and how to prevent these issues. Join Miguel, a security expert watching a video about a cyber detective dealing with a forensic investigation of a kubernetes breach, and find out what the culprit was! If you want to learn more about DFIR, check out our articles: https://sysdig.com/blog/csi-container... https://sysdig.com/blog/guide-kuberne... https://sysdig.com/blog/triaging-mali... https://sysdig.com/learn-cloud-native... --- Chapters: 0:00 Intro 0:18 Incident response 1:14 What is DFIR? 1:44 Kubernetes incident response 4:48 Digital forensics 8:46 Offline analysis with container-explorer 11:05 Attacker POV 13:20 Incident report 14:55 Summary 16:42 Conclusion