Linux IR: Windows of Opportunity

This post-talk Q&A with Jon Wade follows his session on Linux incident response. The discussion opens with why he recommends building a home lab and rebuilding it repeatedly, so responders learn what normal looks like on a Linux system before a real case arrives. He argues that hands-on practice matters more than running a ready-made script that sets the lab up for you.

The middle of the conversation centres on evidence handling. Wade advises against logging into affected hosts to run commands, since that can overwrite memory, expose credentials and compromise a forensically sound disk image. Where possible, he suggests using tools already deployed in the environment, such as configuration management agents or EDR platforms, or writing remote shell scripts that replicate common triage routines. He notes that many enterprise triage tools are simply PowerShell or shell scripts, so teams can build their own. He compares Linux and Windows artifacts, explaining that persistence locations and filesystem metadata differ while the overall IR workflow stays the same. He also recommends early relationships with DevOps teams, with a trained point of contact in each one.

To close, Wade discusses the challenges of aging CentOS and Red Hat-derived distributions, and the scarcity of Linux-only IR roles. He suggests that a responder with Windows experience can learn Linux from the ground up, and that a zero-trust network does not remove the need for incident response. The takeaway is to practise on Linux before an incident happens, keep interaction with live hosts to a minimum, and plan for mixed environments.