Your users must leave systems untouched, and administrators must make only the minimal changes necessary to keep services available. System configuration usually provides evidence of an attack, and changing it cleans up the trail. Also, when users report a possible incident, they should use a telephone rather than e-mail, in case the latter system has been compromised. You must have people with expertise in every operating system, major application, and network device on call to investigate, or recover from, an incident. The team members can change from time to time.
Some teams rotate membership so that the tasks never become too onerous.
Some organizations use their help desk as the point of contact for a potential incident. The help desk doesn't handle the investigation, but it can log the request, provide a trouble ticket number, and contact an available team point person. Among the investigators' first acts should be the notification by phone of other people who should be involved-both network administrators and managers. If the incident is still in progress, the investigators should decide whether they have to shut down the system or monitor traffic and keystrokes. After the triage phase, the investigators need to prevent the incident from happening again.