Protection of Information Assets · Topic 8 of 8
Incident Response, Evidence and Forensics
The incident response life cycle, escalation, containment and recovery, chain of custody, order of volatility and forensic imaging with hash values.
- 3 min
- Includes a diagram
- Life cycle: prepare, detect and analyze, contain, eradicate, recover, review.
- Escalation, communication and breach notification belong in the plan.
- Chain of custody records every handover of evidence.
What it is
Security incident response management is the organization's planned, practised way of handling security incidents so damage is limited, systems recover and lessons are learned. Evidence collection and forensics preserve and analyze digital evidence in a way that stands up to legal and disciplinary scrutiny.
How it works
The incident response life cycle
| Phase | Activities |
|---|---|
| Preparation | Policy, plan, team, tools, contacts, training and exercises |
| Detection and analysis | Confirm the incident, assess scope and severity, classify and escalate |
| Containment | Limit spread, for example isolating systems or disabling accounts, while preserving evidence |
| Eradication | Remove the cause: malware, attacker access, vulnerable configuration |
| Recovery | Restore systems from known good sources, monitor closely, return to normal |
| Post-incident review | Root cause, what worked, what to improve; update plans and controls |
The incident response plan
The plan defines what counts as an incident, severity levels, the incident response team and its authority, escalation paths to management, legal, communications and regulators, communication rules, and links to the business continuity plan. Notification duties for data breaches set by law or contract must be built in, with time frames.
The auditor checks that the plan exists, is approved, is tested through exercises, that incidents are logged and classified consistently, and that post-incident lessons lead to changes.
In a live incident, containment usually comes before eradication, and evidence preservation must be considered before systems are wiped or rebuilt.
Evidence handling
| Principle | Meaning |
|---|---|
| Chain of custody | A record of who collected, handled and stored evidence, when and why, from collection to court |
| Order of volatility | Collect the most volatile evidence first: CPU and memory contents, network connections and running processes, then disk, then logs and backups |
| Forensic imaging | Make a bit-for-bit copy of the storage and analyze the copy, not the original |
| Write blockers | Prevent any change to the original media during imaging |
| Hash values | Calculate hashes of the original and the image to prove they match and nothing changed |
Evidence must be relevant, reliable, complete and collected legally. Mistakes such as switching off a machine, browsing its files or running tools on the original can destroy evidence or make it inadmissible.
Roles
Forensic investigation needs trained staff or specialist firms. Legal counsel should be involved early when the incident may lead to prosecution, litigation or regulatory action. The IS auditor's role is usually to evaluate the process and controls, not to lead the investigation, unless the charter and skills support it.
How the exam asks about this
- "Malware is spreading between servers. What FIRST?" Contain it, for example by isolating the affected systems.
- "How is it shown that a disk image was not altered?" Matching hash values of the original and the image.
- "Which evidence should be collected first?" The most volatile, such as memory.
What to remember for the exam
- Life cycle: prepare, detect and analyze, contain, eradicate, recover, review.
- Escalation, communication and breach notification belong in the plan.
- Chain of custody records every handover of evidence.
- Collect by order of volatility; memory first.
- Image with write blockers, verify with hashes, analyze the copy.
Rebuilding a compromised server immediately restores service but destroys the evidence needed to understand how the attacker got in.
Common mistakes
Skipping the post-incident review. The same incident returns.
Powering off a system before capturing memory.
Analyzing original media instead of a forensic copy.
Check yourself
What does a chain of custody document?
Who collected, handled and stored evidence, when and why, at every step.
Why are hash values calculated during forensic imaging?
To prove that the image matches the original and that neither has been changed.
Which incident response phase removes the attacker's access and malware?
Eradication.
Topic 8 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.