Incident response

Incident response follows a defined process: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. This objective also covers training, testing, root cause analysis, threat hunting, and digital forensics.

The process

Testing, analysis, and forensics

Teams prepare with training and test plans through tabletop exercises and simulations. Root cause analysis looks past the symptom to the underlying cause. Threat hunting is proactive searching for attackers who evaded detection.

Digital forensics preserves evidence for legal use. A legal hold stops deletion of relevant data. Chain of custody documents everyone who handled evidence. Acquisition captures data in order of volatility (CPU cache and memory first, then disk, then archives). Reporting documents findings; preservation keeps original evidence unchanged, using hashes to prove integrity. E-discovery is collecting electronic information for legal cases.

Key terms

Preparation phase

The incident response phase where plans, tools, training, and contacts are put in place before an incident.

Containment

Limiting an incident's spread and impact, for example by isolating hosts or disabling accounts.

Eradication

Removing the cause of an incident, such as malware or an exploited vulnerability.

Recovery

Restoring systems to normal operation and monitoring to confirm the threat is gone.

Lessons learned

A post-incident review of what happened and how to improve controls and response.

Root cause analysis

Investigating the underlying reason an incident happened, not just its symptoms.

Threat hunting

Proactively searching for attackers or malicious activity that evaded existing detection.

Chain of custody

A documented record of who collected, handled, and stored evidence, and when.

Legal hold

A directive to preserve all data relevant to litigation or investigation, suspending deletion.

Order of volatility

Collecting evidence from the most short-lived sources first, such as memory before disk.

E-discovery

Identifying, collecting, and producing electronic information for legal proceedings.