5.6. Security Problems

💡 First Principle: Security problems are distinguished from other failures by intent — someone (or something) is actively attempting to circumvent controls. This changes the diagnostic approach: security incidents require evidence preservation, not just resolution. The order of operations matters: contain first, then investigate, then remediate.