| Titre | Effectuer un exercice sur les leçons apprises |
|---|---|
| ID | RA6002 |
| Description | Conduct Lessons Learned exercise |
| Auteur | @atc_project |
| Creation Date | 31.01.2019 |
| Catégorie | General |
| Étapes | RS0006: Retour d’expérience |
| References | <ul><li>http://shop.oreilly.com/product/0636920043614.do</li><li>https://www.amazon.com/Incident-Response-Computer-Forensics-Third/dp/0071798684</li></ul> |
Workflow
The Lessons Learned phase evaluates the team’s performance through each step.
The goal of the phase is to discover how to improve the incident response process.
You need to answer some basic questions, using developed incident report:
- What happened?
- What did we do well?
- What could we have done better?
- What will we do differently next time?
The incident report is the key to improvements.