Question $4$

In most cases, should a computer incident response team $($CIRT$)$ plan include pursuing the attacker?

It depends on recommendations from law enforcement personnel based on each case.

Yes, a decisive reaction can discourage further attacks.

No$,$ because attackers almost always have more resources and will escalate the attack.

No$,$ because retaliatory attacks may be illegal or result in civil litigation.