Reference #18.50200117.1774122470.b4a6ad7
https://errors.edgesuite.net/18.50200117.1774122470.b4a6ad7
Access Denied
How Early Decisions Shape Incident Response Investigations
Many incident response failures do not come from a lack of tools, intelligence, or technical skills. They come from what happens immediately after detection, when pressure is high, and information is incomplete.
I have seen IR teams recover from sophisticated intrusions with limited telemetry. I have also seen teams lose control of investigations they should have been able to handle. The difference usually appears early. Not hours later, when timelines are built, or reports are written, but in the first moments after a responder realizes something is wrong.
Those early moments are often described as the first 90 seconds. However, taken too literally, that framing misses the point. This is not about reacting faster than an attacker or rushing to action. It is about establishing direction before assumptions harden and options disappear.
Responders make quiet decisions right away, like what to look at first, what to preserve, and whether to treat the issue as a single system problem or the beginning of a larger pattern. Once those early decisions are made, they shape everything that follows. Understanding why those choices matter (and getting them right) requires rethinking what the “first 90 seconds” of a real investigation represents.
The First 90 Seconds Are a Pattern, Not a Moment
One of the most common mistakes I see is treating the opening phase of an investigation as a single, dramatic event. The alert fires, the clock starts, and responders either handle it well or they do not. That is not how real incidents unfold.
The “first 90 seconds” happens every time the scope of an intrusion changes.
You are notified about a system believed to be involved in an intrusion. You access it. You decide what matters, what to preserve, and what this system might reveal about the rest of the environment. That same decision window opens again when you identify a second system, then a third. Each one resets the clock.
This is where teams often feel overwhelmed. They look at the size of their environment and assume they are facing hundreds or thousands of machines at once. In reality, they are facing a much smaller set of systems at a time. Scope grows incrementally. One machine leads to another, then another, until a pattern starts to emerge.
Strong responders do not reinvent their approach each time that happens. They apply the same early discipline every time they touch a new system. What was executed here? When did it execute? What happened around it? Who or what interacted with it? That consistency is what allows scope to grow without control being lost.
This is also why early decisions matter so much. If responders treat the first affected system as an isolated problem and rush to “fix” it, they close a ticket instead of investigating an intrusion. If they fail to preserve the right artifacts early, they spend the rest of the investigation guessing. Those mistakes can compound as the scope expands.
How Investigations are Hindered
When early investigations go wrong, it is tempting to blame training, hesitation, or poor communication. Those issues do show up, but they are usually symptoms, not root causes. The more consistent failure is that teams do not understand their own environment well enough when the incident begins.
Responders are forced to answer basic questions under pressure. Where does data leave the network? What logging exists on critical systems? How far back does the data go? Was it preserved or overwritten? Those questions should already have answers. When they do not, responders end up learning the critical components of their environment after it’s too late.
This is why logging that starts following a detection is so damaging. Forward visibility without backward context limits what can be proven. You may still reconstruct parts of the attack, but every conclusion becomes weaker. Gaps turn into assumptions, and assumptions turn into mistakes.
Another common failure is evidence prioritization. Early on, everything feels important, so teams jump between artifacts without a clear anchor. That creates activity without progress. In most investigations, the fastest way to regain clarity is to focus on evidence of execution. Nothing meaningful happens on a system without something running. Malware executes. PowerShell runs. Native tools get abused. Living off the land still leaves traces. If you understand what was executed and when, you can start to understand intent, access, and movement.
From there, context matters. That could mean what system was accessed around that time, who connected to the system, or where the activity moved next. Those answers do not exist in isolation. They form a chain, and that chain points outward into the environment.
The final failure is premature closure. In the interest of time, teams often reimage a system, restore services, and move on. Except that incomplete investigations can leave behind small, unnoticed pieces of access. Secondary implants. Alternate credentials. Quiet persistence. A subtle indicator of compromise does not always reignite immediately, which creates the illusion of success. If it does resurface, the incident feels new when, in reality, it is not. It is the same one that was never fully remediated.
Join us at SANS DC Metro 2026
Teams that can get the opening moments right enable difficult investigations to become more manageable. Effective incident response is about discipline under uncertainty, applied the same way every time a new intrusion comes into scope. However, it is important to give yourself grace. No one starts out good at this. Every responder you trust today learned by making mistakes, then learning how not to repeat them the next time.
The goal is not to avoid incidents entirely. That is unrealistic. The goal is to avoid making repetitive mistakes under stress. That only happens when teams are prepared before an incident forces the issue. Because when they understand their environments, they can practice identifying execution, preserving evidence, and expanding scope deliberately while the stakes are still low.
When investigations are handled with that level of discipline, the first 90 seconds feel familiar rather than frantic. The same questions get asked, and the same priorities guide the work. That consistency is what allows teams to move faster later, with confidence instead of guesswork.
For responders who experience these challenges in their own investigations, this is exactly the mindset and methodology taught in our SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics class. I will be teaching FOR508 at SANS DC Metro on March 2-7, 2026, for teams that want to practice this discipline and turn insights into action.
Note: This article has been expertly written and contributed by Eric Zimmerman, Principal Instructor at SANS Institute.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Source link
Guardiola on Palestinian struggle and ICE protests in football briefing | Israel-Palestine conflict
‘When you have an idea, you need to defend it.’ In Manchester City’s pre-match press conference on Tuesday, manager Pep Guardiola chose to speak about Palestinians suffering in Gaza and ICE protests in the US.
Published On 4 Feb 2026
Source link
The banquet was going on amidst the mourning, the restaurant was mistaken for a bunch of tourists, the family’s decision won the hearts of the people.
Last Updated:
One family’s generosity has become an example in Thailand. After his death, the family was organizing a feast amidst mourning. But thinking it was a buffet, two groups of tourists came there to eat. What the family did after this won everyone’s hearts.
A family in Thailand is in the news these days. This family made some tourists who had come to the banquet in their house sit and feed them with love. These tourists had come to visit Thailand. He mistook the banquet for a food court and entered inside to eat.
The family had organized a traditional feast after the death of their relative. This feast was in memory of the deceased, where family and relatives gathered. A group of foreigners also entered there. But the family members served him the food without interrupting. The reality came out when the tourists asked for the bill.
Samjha Regular Buffet
Buffet is organized at many places in Thailand. Foreigners go there and enjoy local food. These groups also considered the banquet to be a buffet of a normal restaurant and started eating. The family did not stop him even after seeing unknown people. On the first day the tourists ate a lot and left. The same groups came again the next day. This time the family welcomed him with a smile and served him food. The tourists later came to know that this feast was held after someone’s death. He was shocked and started apologizing to the family. But the family asked them to eat freely.
pictures went viral
Pictures and videos of this incident went viral on social media. People are calling this an example of humanity. The family was from a small town in Thailand, where local tradition involves holding a feast in memory of the deceased. The landlord or relatives said that the deceased had always said that “one should take everyone along in life.” The family adopted the same sentiment. The tourists later posted on social media, “We made a mistake, but the family who forgave us and fed us is the real hero.” This incident continued for three days. On the first day two groups, on the second day again the same people and on the third day some new tourists also joined. The family welcomed us with a smile every time. People are writing on social media – “So much generosity even in sorrow”, “This is real culture”, “Example of hospitality of Thailand”. This story teaches us how important it is to take care of the happiness of others even in times of sorrow. The family not only fed the tourists but also gave them a sense of belonging.
About the Author
Sandhya Kumari
I am working as a senior sub editor in News 18. The aim of the regional section is to introduce you to the events happening in the states which are being liked on social media. So that you don’t miss any viral content.
Access Denied
Reference #18.4d560e17.1774124245.be0c322
https://errors.edgesuite.net/18.4d560e17.1774124245.be0c322
Gorton and Denton by-election tests Labour’s grip on heartland voters | Elections News
Internal rifts, growing support for smaller parties are challenging Labour’s dominance in Greater Manchester.
A by-election in northern England that should have been routine for the governing Labour Party is instead becoming a test of how fragmented British politics has become.
Voters in the Gorton and Denton constituency of Greater Manchester are set to cast ballots on February 26 after long-serving MP Andrew Gwynne resigned in January.
Eleven candidates are vying for the seat: Sir Oink A-Lot (Official Monster Raving Loony Party); Nick Buckley (Advance UK); Charlotte Cadden (Conservative Party); Dan Clarke (Libertarian Party); Matt Goodwin (Reform UK); Sebastian Moore (Social Democratic Party); Joseph O’Meachair (Rejoin EU Party); Jackie Pearcey (Liberal Democrats); Hannah Spencer (Green Party); Angeliki Stogia (Labour Party); and Hugo Wills (Communist League).
For years, Gorton and Denton was considered a Labour stronghold, but now the party faces a battle amid growing voter dissatisfaction and internal friction.
The lead-up to the vote has been dominated by a high-profile dispute over the selection of Labour’s new candidate after a bid by Greater Manchester Mayor Andy Burnham to stand as the candidate was blocked, with the party’s leadership choosing Stogia, a local councillor, to defend the seat.
Still, Labour commands loyal support. “[They do a] very good job and we support them,” Khaled Osman, a local supporter, told Al Jazeera. “We appreciate everything they do: the support for refugees, for asylum, and for the people who work hard.”
Not everyone, however, in this diverse and relatively deprived constituency feels that way.
“The sooner Labour’s out of power, the better,” said resident Colin Hensey, pointing to the decline of local services. “Wherever you go, you’re trying to get a doctor’s appointment now. And yet, this is why everybody is going off to the A&E [accident and emergency] because they can’t get local appointments at the surgery. We never had this problem 20, 30 years ago.”
On Labour’s left flank, the Green Party is positioning itself as an alternative, arguing that the governing party has moved away from some the values it once championed.
The far-right Reform UK is also vying for a victory, presenting itself as the anti-system voice – tough on immigration and crime, and openly hostile to what it calls a broken political class.
“I think Labour’s let us down for years,” said Carl Morris, a Reform supporter. “I’ve worked in Denton for 28 years now, and the place is just full of rubbish. People are dumping stuff all over the show. Labour’s done nothing for this town.”
Reporting from Gorton and Denton, Al Jazeera’s Sonia Gallego said every single vote will count in the seemingly tight contest later this month.
“It is a struggle for who gets to channel the frustrations felt here and where it goes next,” she added.
Source link
Pakistani Hindu refugees living in Majnu Ka Tila appeal to the government, ‘Now give them houses too’
trending
21 tola gold and 71 lakh cash… the groom got so much dowry in the wedding, you will lose your senses while counting, watch video
America can enforce strong immigration law without abandoning decency
NEWYou can now listen to Fox News articles!
Our broken immigration system is a stain on both major political parties and leaders, who have instead burdened us with massive debt, the world’s most expensive healthcare and medicines, an uninspired, second-tier public education system and policies that actually incentivize illegal crossings of our borders.
Ronald Reagan would be appalled at both parties, and George Washington would say he warned us as we find ourselves at yet another disconcerting moment in American history.
Today’s crisis is one of our own making: a battle over immigration enforcement in Minnesota — a low-crime state estimated to be home to just 100,000 undocumented people, about half the national average per capita and nowhere close to the millions residing in sunny Texas and Florida. Needless to say, it’s not a stretch to believe Operation Metro Surge is a campaign of provocation and retribution rather than resolution. It’s also not a stretch to contend that common-sense Americans (myself included) believe the porous southern border enabled by former President Biden was as absurd and unreasonable as attempting to deport 14 million undocumented people as current President Donald Trump is endeavoring to accomplish at this very moment.
While we should all celebrate the removal of undocumented criminals from our streets, the misguided and mismanaged effort in Minneapolis will be remembered as one of the most horrifying abuses of American law and decency in my lifetime. It killed two American citizens in cold blood and trampled on the civil rights of countless others, including multiple off-duty police officers in the Twin Cities who were accosted by roving, masked, ID-less, armed ICE agents because they were brown, or black, or spoke with an accent. But the operation did accomplish something that had seemed impossible just a month ago: a progressive left unified with gun-rights advocates, libertarians, police chiefs, rule-of-law Republicans and even a Republican senator retiring at the end of his term and liberated to speak the truth.
While the America to which Ronald Reagan aspired seems like a distant dream, I believe the better angels of America’s massive majority recognize the horrifying consequences posed by incompetent leadership and moral breaks in our national fabric.
Some on the left view Immigration and Customs Enforcement (ICE) as an occupying force — an agency to be resisted at every turn. Others on the right see local pushback as undermining lawful immigration enforcement and local public safety.
But to the massive majority, this binary is a false choice.
JONATHAN TURLEY: DEMOCRAT POLITICIANS ARE RISKING LIVES WITH RECKLESS ANTI-ICE RHETORIC
The executive branch has constitutional authority to enforce immigration law, and that mandate doesn’t magically disappear because state or local officials object. That’s why some level of cooperation — even if reluctant — makes sense. It prevents chaotic clashes between different authorities, allows shared information and oversight, and ensures enforcement actions are transparent. Refusing to cooperate entirely only heightens tensions and leaves communities less protected and more polarized.
Yes, cooperation must be thoughtful, conditional and rooted in respect for civil liberties. It should not be blind support for every tactic an agency employs. But neither should it be principled obstruction that fuels distrust and diminishes accountability.
Democrats and Republicans alike should want cooperation where it reinforces constitutional order, protects public safety and ensures due process. That’s not capitulation — it’s common sense governance.
DAVID MARCUS: SPURNING TRUMP MEANS MAYOR JACOB FREY OWNS MINNEAPOLIS MESS
Let’s be clear: the fallout from this operation has been horrifying. People have died. Families have been torn apart. Young children have been detained. These are real harms that demand accountability and reform — not spin and not deflection.
At the same time, dismissing all enforcement as illegitimate invites lawlessness and undermines the very framework of the rule of law, due process and judicial review that protects civil liberties in our country. We don’t want an abdication of enforcement authority, rather a reimagined approach that respects constitutional due process and civil rights.
This is where local cooperation can actually be a force for reform. When state and city officials engage with federal agents, they can help ensure enforcement measures are proportionate, targeted and transparent — rather than arbitrary and alienating.
BIDEN SPEAKS OUT AGAINST IMMIGRATION CRACKDOWN IN MINNESOTA, SAYS IT GOES AGAINST AMERICAN VALUES
But we’ll keep finding ourselves in this destructive battle until we address the root causes once and for all. And there is more common ground on immigration policy than many recognize. I believe:
1. Most of us want a lawful, orderly immigration system that attracts and welcomes high potential contributors while offering reasonable refuge to the oppressed.
2. Most of us want the quick removal of undocumented, convicted criminals, and the application of due process, human dignity and judicial review before the deportation of others.
WHY TRUMP SENDING TOM HOMAN TO MINNESOTA IS A STROKE OF ABSOLUTE GENIUS
3. Most of us want honesty and accountability from federal, state, and local agencies charged with enforcing our laws and protesters who exercise their rights peacefully.
4. Most of us want to fix the broken system with majority support for: Changing our asylum laws, which currently require asylum seekers, legitimate or not, to physically set foot in the United States. That means our law essentially requires an illegal border crossing to legally apply for asylum. Why not require applications to be filed at one of our consulates or embassies around the world before crossing our border?
Devising a pathway to citizenship for those contributing to America, who confess to illegally crossing our borders, who pay a fine to the US Treasury, and who fulfill citizenship education.
SEN RUBEN GALLEGO: I WON’T FUND A ROGUE ICE THAT SHOOTS FIRST AND CALLS IT LAW ENFORCEMENT
Raising the physical bar for illegal immigration and lowering the administrative bar for legal immigration. We should be recruiting the world’s best and brightest while remaining a place of refuge for the oppressed.
CLICK HERE FOR MORE FOX NEWS OPINION
In the meantime, we must come to some resolution on the leadership and tactics of ICE and uncooperative sanctuary states and cities. Minnesota leaders have rightly voiced their concerns about the violence and societal disruptions tied to these enforcement actions. These voices matter and should be part of the national conversation on reform.
But full resistance — refusing any cooperation — risks turning legitimate grievance into fruitless confrontation. That’s why cities and states should engage with enforcement agencies strategically to make immigration enforcement more just instead of creating battlegrounds that magnify mistrust.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Conflict always presents the possibility for collaboration. The current crisis shouldn’t be an end point, rather a turning point — one where Americans of all political stripes prioritize reforms and enforcement that’s lawful, humane, transparent and accountable.
It’s surely the agenda Ronald Reagan would have fought for, and one we’d be foolish not to embrace as a great nation of immigrants.
Source link
any hope for bangladesh: Can Bangladesh return to the World Cup, how can ICC think?
Last Updated:
any hope for bangladesh: For Bangladesh, raising the issue of ‘cheating’ in front of ICC can create diplomatic pressure, but getting a chance to play again in the middle of the World Cup is outside the rule book.
New Delhi. Cricket is a game of uncertainties, where sometimes the ball rotates on the pitch and sometimes there are politics and equations outside the field. Recently, there is a strong discussion among Bangladeshi cricket fans whether Bangladesh can again demand its place in the T20 World Cup after any kind of sports related ‘fraud’ or technical dispute with Pakistan. Rules are stronger than emotions at the ICC table, but is there any ‘chor door’ or ‘promotion’ door open for Bangladesh in the corridors of cricket?
Defeat on the cricket field can be avenged only by victory in the next match. For Bangladesh, raising the issue of ‘cheating’ before the ICC may create diplomatic pressure, but getting a chance to play again in the middle of the World Cup is outside the rule book. Even if he raises his voice strongly on the ICC platform, the chances of anything happening now are slim to none.
Is it possible to demand a replay?
According to ICC rules, once the tournament schedule is decided and the match results are officially declared, it is almost impossible to change it. History is witness to the fact that ICC rarely takes a decision to re-organize a match. Now that Scotland have been invited, it is very difficult in practice to talk about a ‘replay’ at the World Cup.
2. ICC ‘Promotion’ and Bangladesh’s situation
The term ‘promotion’ is usually used for associate countries (such as Nepal or the US) who want to move up in the main rankings. Bangladesh is already a ‘full member’ nation. If Bangladesh proves to the ICC that they have been treated unfairly, then the ICC can give them a kind of ‘promotion’ or relief by giving them ‘direct qualification’ or ‘higher seeding’ for the next tournament.
3. Is there any legal or technical way?
If the Bangladesh Cricket Board (BCB) feels that they have been ‘cheated’ on a large scale, then they can take the following steps: They can present evidence before the ICC Executive Committee. If a dispute occurs during a bilateral series, the ICC may order extra points as compensation or a restructuring of the series. In very serious cases the matter can go to the ‘Court of Arbitration for Sport’, although this is rarely seen in cricket. Although there is always hope for justice in cricket, but for Bangladesh at the moment all that can be said is that would anyone regret now when the bird has pecked at the field?
Access Denied
Reference #18.4d560e17.1774125994.bf28be4
https://errors.edgesuite.net/18.4d560e17.1774125994.bf28be4