ਤੁਸੀਂ ਸੁਰੱਖਿਆ ਘਟਨਾਵਾਂ ਅਤੇ ਉਲੰਘਣਾ ਦੋ ਨੂੰ ਕਿਵੇਂ ਸੰਭਾਲਦੇ ਹੋ?

Despite defenses, security incidents WILL happen (no system is perfectly secure):
  → being PREPARED to respond limits damage, downtime, and data loss
  → a poor/slow/panicked response makes breaches far worse
→ have a PLAN before you need it (you can't improvise a good response mid-crisis).

1. PREPARATION → plan, tools, roles, runbooks, monitoring/logging in place beforehand
2. DETECTION & ANALYSIS → identify the incident (monitoring, alerts); assess scope/severity
3. CONTAINMENT → stop the spread/limit damage (isolate affected systems, revoke access)
4. ERADICATION → remove the threat (close the vulnerability, remove malware/access)
5. RECOVERY → restore systems safely; verify they're clean; resume operations
6. POST-INCIDENT (lessons learned) → analyze what happened, improve defenses & the process
   (BLAMELESS — focus on fixing, not blaming)