Summary
- Security spans identity, devices, software, networks and suppliers; no single product owns the whole incident.
- The response plan should assign containment, clean restoration, evidence preservation and user notification.
Internet security protects connected systems and data from misuse, interruption and loss. Controls are distributed, so gaps often appear at the handoff between a provider, internal team and user. Organisations should maintain an asset list, strong identity controls, supported software, tested backups and a reachable abuse contact. Automation can shorten detection but must not obscure who authorises containment. The next useful evidence is a timed incident exercise with a real restoration and communication step. Responsibility becomes credible when it is exercised, not when it is written in a policy.
