Definition
Incident investigation is the systematic process of analyzing a security breach or disruptive event to understand its root cause, scope, and impact. It involves gathering and preserving evidence, identifying the attack vector, and determining the extent of compromise. This meticulous examination allows organizations to respond effectively, contain damage, and prevent future occurrences. Practitioners follow established protocols to collect digital forensics data, interview witnesses, and reconstruct timelines of events. Understanding how an incident happened is crucial for improving security posture and protecting critical assets. For instance, investigating a ransomware attack might reveal a phishing email as the initial entry point. This differs from incident response, which focuses on immediate containment and eradication, whereas investigation delves into the 'why' and 'how' after the initial chaos. This concept is fundamental to cybersecurity certifications like CompTIA Security+ and CySA+.