- 4.8 - Explain appropriate incident response activities
- Understand the incident response lifecycle
- Know common containment, eradication, and recovery actions
- Incident Response
- Preparation
- Detection and Analysis
- Containment
- Eradication
- Recovery
- Lessons Learned
- Key Takeaways
- Incident Response: Process of preparing for, detecting, analyzing, containing, eradicating, recovering from, and learning from security incidents.
- A structured process reduces confusion during high-pressure events.
Preparation includes:
- Playbooks
- Contact lists
- Logging
- Tools
- Access permissions
- Backups
- Training
- Tabletop exercises
- Determine whether an alert is a real incident.
- Identify affected users, systems, IPs, files, and data.
- Build an initial timeline.
Questions:
- What happened?
- When did it happen?
- Which assets are affected?
- Is the threat still active?
- What evidence supports the conclusion?
- Containment: Limiting damage and stopping spread.
Examples:
- Disable account
- Isolate endpoint
- Block IP or domain
- Remove system from network
- Disable compromised API key
- Eradication: Removing the cause of the incident.
Examples:
- Remove malware
- Patch exploited vulnerability
- Delete persistence mechanism
- Rebuild compromised system
- Remove unauthorized account
- Recovery: Restoring systems to normal operation.
Examples:
- Restore from backup
- Reconnect cleaned systems
- Reset credentials
- Monitor for recurrence
- Validate business service operation
- Review what happened after the incident.
- Identify root cause, timeline, impact, response actions, and improvements.
- Incident response controls damage and restores operations.
- Documentation and evidence are important throughout the process.