It can be a complex, painful process. It will involve looking at log files for just about anything, resetting some set of passwords, engaging outside counsel, e

It can be a complex, painful process. It will involve looking at log files for just about anything, resetting some set of passwords, engaging outside counsel, engaging a forensic/IR firm. And it is often a race against various competing priorities. For example, if there is an attacker actively working into your system, one temptation is to totally turn that ingress off. However, if the attacker is sophisticated, then they know that they have been detected, and may well find yet another route into your systems that is harder for you to spot. This can be proactively addressed by having an IR plan, and occasional table-top exercises too address select scenarios. Executive buy-in is critical.