The Incident Response Process

What it is

An event is any observable occurrence in a system or network. An incident is an event, or a set of events, that harms or threatens the confidentiality, integrity or availability of information or systems, or breaks a security policy.

Incident response (IR) is the planned, repeatable way an organisation handles incidents so that damage is limited and normal service returns quickly. Following the same phases every time avoids panic and mistakes.

How it works

The widely used National Institute of Standards and Technology (NIST) model (Special Publication 800-61 Revision 2) has four phases: preparation, detection and analysis, containment with eradication and recovery, and post incident activity. CySA+ breaks the middle of that model into separate steps: preparation, detection, analysis, containment, eradication and recovery, followed by a post incident review. In practice the phases overlap, and the team may loop back as it learns more.

Preparation

Everything done before an incident happens.

• IR policy and plan: approved by management, giving authority and defining what counts as an incident.
• IR team: often called a computer security incident response team (CSIRT), with defined roles, an incident commander, and contacts for legal, human resources, communications and executives.
• Playbooks: step by step guides for common types such as ransomware or phishing.
• Tools and access: logging, forensic tools, clean communication channels, backups and access to systems.
• Training and exercises: a tabletop exercise talks through a scenario, and simulations test tools and actions in practice.
• Communication plan: who is told what, and how, including out of band methods if email is compromised.

Detection and analysis

Detection is noticing a possible incident from alerts, user reports, threat intelligence or third party notices. Analysis decides whether it is real and what it affects.

1. Validate: is it a true incident or a false positive?
2. Scope: which systems, accounts and data are involved, and since when?
3. Classify: what type is it, such as malware, unauthorised access or data loss?
4. Prioritise: based on business impact, the type of information affected and how hard recovery will be.
5. Document: keep a time ordered log of observations and actions from the start.

Containment

Containment stops the incident from spreading or causing more harm. Choose a strategy based on the impact on the business, the need to keep evidence, the time and resources needed, and how long the solution will last.

Isolation (also called quarantine) keeps the system on but cuts its network access, which preserves volatile evidence. Turning a machine off loses memory contents, so avoid it unless there is a reason.

Eradication

Eradication removes the cause and what the attacker left behind: malware, backdoors, rogue accounts and scheduled tasks. It also closes the weakness that let the attacker in, for example by patching, and resets compromised credentials.

For serious compromises, rebuilding from a known good image is safer than cleaning, because hidden persistence is hard to prove gone.

Recovery

Recovery returns systems to normal operation. Restore from known good backups, rebuild, test and bring services back in stages. Monitor closely for signs of the attacker returning, and confirm with business owners that services work.

Post incident activity

After the incident is closed, hold a lessons learned meeting. Review what happened, what worked, what failed and what to change, then update plans, playbooks and controls. A written report records the timeline, impact, cause and actions.

Roles and communication

• Incident commander or manager coordinates the response.
• Analysts and technical leads investigate and contain.
• Legal and compliance advise on notification duties and evidence.
• Communications or public relations handle messages to the public and staff.
• Executives make business decisions on cost and risk.