Troubleshooting a Live Security Incident | Joshua Moses | Cybertrace Foundation

The hardest diagnosis of all: reasoning about a system an intelligent adversary is actively manipulating while you work. You sometimes have to contain before you understand, and the attacker is planting false leads. Joshua Moses | Cybertrace Foundation | Troubleshooting | Video 17 of 32 WHAT YOU WILL LEARN IN THIS VIDEO • Why incident troubleshooting is the hardest, with an adversary actively manipulating the system • The scoping diagnosis, and the first question of how far the compromise has spread • The what-happened reconstruction, building the timeline of the attack from the evidence • The adversary-in-the-loop reality, and how normal diagnostic assumptions break • The contain-before-you-fully-understand tension, acting to limit damage before diagnosis is done • The evidence-under-pressure discipline, gathering and preserving while the incident is live • The false-lead problem, diagnosing against an adversary planting misdirection • Incident failures: the underestimated scope, the tip-off during containment, the false lead HANDS-ON LAB EXERCISE Work a staged live incident in the lab, scoping the compromise and reconstructing the timeline while an adversary's misdirection tries to send your diagnosis wrong. WHO THIS VIDEO IS FOR Built for IT support and help desk staff, system and network administrators, DevOps and site reliability engineers, and anyone who wants to diagnose the cause of a problem by reasoning rather than by guessing and swapping parts until something works. ABOUT THE SERIES This is video 17 of the Troubleshooting course from Joshua Moses | Cybertrace Foundation. Every video teaches at an intermediate level while staying understandable to someone starting from zero, builds on the same hands-on lab from the first video to the last, and ends with an exercise you work yourself. This 32-part series teaches one transferable diagnostic method and then applies it across hardware, operating systems, networks, applications, databases, identity, cloud, and live security incidents, plus the hard cases: intermittent, cascading, and unfamiliar faults. Subscribe so you catch each one, and leave a comment if something here needs a deeper explanation. Course Lab Guides: Troubleshooting https://github.com/joshuanmoses/Cyber...