Security Operations
Incident response
Lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment choices - isolating a host, blocking a port, segmenting a network - are driven by business impact. Do not destroy evidence to clean up faster.
Forensics
Order of volatility: CPU registers and cache, then memory, then network state, then disk, then backups and archival media. Collect the most volatile first. Chain of custody, integrity hashing, write blockers, and documented handling make evidence defensible. Legal holds and interviews are coordinated with counsel.
Availability
RTO is the maximum tolerable downtime; RPO is the acceptable data loss window; MTD bounds recovery design. Backups: full, incremental (since the last backup of any kind), differential (since the last full). Know the restore chain - incremental restores require the full plus every increment. Hot, warm, and cold sites reduce RTO in that order and increase cost.
Operational hygiene
Change management, configuration baselines, patch management, separation of duties, job rotation, and mandatory vacation limit insider fraud. Rotation and vacation are detective, not preventive. Least privilege and need to know govern access. Environmental controls include fire classes, clean-agent suppression with interlocks for electrical rooms, humidity, and temperature monitoring.
Rule of thumb
If an incident may become legal, secure evidence first. Before answering any "what should the administrator do first?" item, ask whether the action destroys volatile data; that check eliminates rebooting, reformatting, and reinstalling - options that look like recovery but erase the trail.