ABSTRACT
This chapter describes the fifth component of an effective information security/ IA program — conducting an accident/incident investigation. The process of how to conduct and accident/incident investigation is explained, as well as the reasons why one should conduct an investigation. The following activities are performed while conducting an accident/incident investigation:
The cause, extent, and consequences of the failure/compromise are analyzed.
