Incident Response · Topic 1 of 4
Incident Response, First Response and the Handling Process
Learn the incident response concept, the first responder role, first response do's and don'ts and the incident handling process for CND 312-38.
- 5 min
- Incident response aims to limit damage, restore service, preserve evidence and learn.
- The first responder secures, preserves, documents and escalates.
- Collect in order of volatility, and keep a chain of custody.
What it is
An information security incident is an event that harms, or threatens to harm, the confidentiality, integrity or availability of information or systems. Incident response (IR) is the organized approach to preparing for, detecting, containing and recovering from such incidents, and to learning from them.
The goal is to limit damage, restore service quickly, preserve evidence and reduce the chance of a repeat. A defined plan, a trained team and clear authority make the difference between a controlled response and chaos.
How it works
The incident response concept
A written IR plan and policy define what counts as an incident, who is on the computer security incident response team (CSIRT), who has authority, and how to communicate. Typical roles are the incident manager, analysts, a communications lead, legal and human resources, and executive sponsors.
| Common incident category | Example |
|---|---|
| Malicious code | Ransomware or a worm |
| Unauthorized access | Stolen credentials used to log in |
| Denial of service | Traffic flood against a service |
| Data breach | Personal data leaves the organization |
| Inappropriate use | An employee violates the acceptable use policy |
| Insider threat | A user abuses valid access |
Incidents are rated by severity (impact and urgency) so the response matches the risk. NIST SP 800-61 is the widely used guide for incident handling.
Role of the first responder
The first responder is the first person with the right skills to arrive at an incident, such as a help desk analyst, system administrator or security staff member. What they do in the first minutes decides whether evidence survives.
Responsibilities:
- Identify and confirm that an incident is happening
- Secure the scene and limit access to affected systems
- Preserve evidence, in order of volatility
- Document everything seen and done, with times
- Notify the right people through the escalation path
- Hand over to the response team without altering the evidence
Do's and don'ts in the first response
| Do | Don't |
|---|---|
| Follow the incident response plan | Panic or act on guesswork |
| Document time, actions and observations | Work from memory later |
| Keep a chain of custody for evidence | Let evidence pass hands without a record |
| Isolate affected systems from the network when instructed | Power off a running system without thought, because memory contents are lost |
| Capture volatile data first | Run tools on the affected system that change files and timestamps |
| Make forensic copies and work on the copies | Work on the original evidence |
| Escalate quickly to the incident handler | Discuss the incident with the public or on social media |
| Limit the number of people with access | Delete files, reboot or reinstall to clean it up early |
Order of volatility (RFC 3227) is the order in which to collect evidence: processor registers and cache, then routing table, ARP cache, process table and memory, then temporary files, then disk, then remote logs and monitoring data, then physical configuration and network topology, and last archival media.
The incident handling and response process
NIST SP 800-61 Rev. 2 describes four phases: preparation, detection and analysis, containment, eradication and recovery, and post incident activity. EC-Council lays the work out as nine stages.
| Stage | Purpose |
|---|---|
| 1. Preparation | Policy, plan, team, tools, training and contacts ready before anything happens |
| 2. Incident recording and assignment | Log the report and assign it to a handler |
| 3. Incident triage | Confirm, classify and prioritize by severity and scope |
| 4. Notification | Inform management, legal, affected parties and authorities as required |
| 5. Containment | Stop the spread, for example isolate a host or block an address |
| 6. Evidence gathering and forensic analysis | Collect and examine evidence to learn what happened |
| 7. Eradication | Remove the cause, such as malware, bad accounts and the exploited weakness |
| 8. Recovery | Restore systems from clean sources, test them and return to service |
| 9. Post incident activities | Lessons learned, report, plan updates and improvements |
Containment can be short term (disconnect the host) then long term (rebuild in a clean segment). Eradication comes before recovery, since restoring a system that still contains the intruder just reopens the incident.
A worked example
A help desk technician sees a user whose files all have a new extension and a ransom note on the screen. She does not reboot the PC. She unplugs its network cable, photographs the screen, notes the time, and reports it through the escalation path.
The incident team triages it as ransomware with high severity, contains related shares, collects memory and disk images, removes the malware, restores data from clean backups and later holds a review that updates the plan.
How the exam asks about this
- "Which phase of incident handling is concerned with stopping the spread of an incident?" → Containment.
- "Who is the first person with the right skills to arrive at the scene of an incident?" → The first responder.
- "Which evidence should be collected first?" → The most volatile, such as memory and registers.
What to remember for the exam
- Incident response aims to limit damage, restore service, preserve evidence and learn.
- The first responder secures, preserves, documents and escalates.
- Collect in order of volatility, and keep a chain of custody.
- Containment comes before eradication, and eradication before recovery.
- A post incident review feeds back into the plan.
Powering off a compromised machine to stop the damage destroys memory evidence. Follow the plan, and isolate from the network first when possible.
Common mistakes
Cleaning up before collecting evidence. Deleting files or rebuilding the host destroys the proof.
Skipping the post incident review. Without it the same weakness is exploited again.
Having no preparation. A plan written during the incident is too late.
Check yourself
What does the first responder do first?
Confirms the incident, secures the scene, preserves volatile evidence and documents, then escalates.
Which comes first, eradication or recovery?
Eradication, because recovering a system that still has the threat reopens the incident.
What is the purpose of the order of volatility?
To collect the most short lived evidence, such as memory, before it is lost.
Topic 1 of 4 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.