3,500 emails in half an hour. And no one at the company sent them.
A cyber incident that began with thousands of messages: containment, focused investigation and broader security protection, with the company's budget in mind.
Real incidents, firsthand experience
Stories from the Field
Cases from Moshe Goldman's work: the first signs, the decisions and the actions taken.
It started with a slow computer
A complaint about a slow computer led to an investigation of access tools, suspicious processes and connections, and a structured response plan.
The alert came from a former client
An unusual alert led to an intrusion investigation, followed by rebuilding a system and recovering data when the normal restore process failed.