Interview Guides
A client has reported signs of a possible data breach, and you have been asked to lead the initial technical investigation. You need to act quickly enough to preserve evidence and reduce further exposure, while avoiding premature conclusions that could disrupt business operations or contaminate forensic data.
If a client suspects a data breach, what are the first three technical steps you would take to investigate?