# Incident response report

- For **the client**  
  1st Independance Street  
  SOMEWHERE
- by **Happy Dev**
- updated 1970-01-01

## Executive summary

### Context

> Description of the incident and the objectives of the reponse.

### Conclusion about the incident

> Conclude about the findings.

---

## Timeline of the incident

* 1970-01-01: Happy Dev starts the investigation

## Findings and recommendations

This section gives technical details about how the results have been obtained and the conclusion made.

It also gives context and details about the recommendations. Those recommendations are made on security perspective and the client should evaluate their business impact before implementation.

This part of the report is likely to contain sensitive informations and therefor shouldn't be available publicly.

**Summary of the recommendations**:

| Actions                                                 | Assets     | Criticity | Complexity |
|---------------------------------------------------------|------------|-----------|------------|
| Do something about the beach                            | Servers    | 5/5       | 3/5        |

> All the following sections should highlight the risks and give recommandation to mitigate it:  
> **Risk**: All the network stack of the server is exposed. It could lead to the unwanted exposure of local services.  
> **Recommendation**: Activate firewalls on servers with a restrictive flow matrix.

### Incident impact analysis

> This section should give details about the data or service loss.

### Network audit

#### Server exposition

#### Filtering policy

#### Routing tables

#### Listening services

#### Remote administration

### Operating system audit

#### Automatic system upgrades

#### Programs with extended permissions

#### Users authorizations

#### Recurring tasks

### Services audit

### Application audit

---

## Appendices

