5.6. Security Problems

💡 First Principle: Security problems are distinguished from other failures by intent — someone (or something) is actively attempting to circumvent controls. This changes the diagnostic approach: security incidents require evidence preservation, not just resolution. The order of operations matters: preserve evidence and analyze what happened, contain the threat, then remediate. Rebooting or cleaning first destroys the evidence you need.