Tips to prep Windows networks for proper incident forensics

The video tutorial discusses a cybersecurity advisory from the Five Nations, emphasizing the importance of setting up proper logging and understanding systems before incidents occur. It highlights the need for forensic investigation training and the use of tools like FTK Imager and Eric Zimmerman's resources. The tutorial also covers the significance of understanding system baselines using command lines to detect anomalies and stresses the importance of addressing root causes of incidents rather than just symptoms.

What are the recommended steps to take before a cybersecurity incident occurs?

How can cyber insurance assist during a cybersecurity incident?

Why is it important to understand what is normal on your system?

What is the significance of forensic backups in incident response?

What tools or commands can be used to monitor system activity?