Practical cybersecurity guides, labs & compliance
Run a 30-minute ransomware tabletop with five fictional scenario cards. Assign decision owners, record unknowns, and leave with three follow-up actions. Includes a decision log; discussion results do not replace restoration tests.
Check CloudTrail coverage, delivery, integrity, retention and retrieval against your evidence needs. Use the retrieval record to document an authorized test and distinguish recent Event history from a protected archive.
Review an incident-response retainer through activation terms, availability, decision authority and costs. Use the worksheet to separate acknowledgement from containment and record evidence handling, escalation and the work your team retains.
Review suspected Bash or Zsh history exposure without copying or replaying secrets. Use the response card to record access context, owner-led credential containment and the limits of history settings or deletion.