Incident Response Processes
Summary
PDF p.296A cybersecurity incident involves a violation of an asset's security properties, affecting its confidentiality, integrity, or availability. Incident response (IR) policies outline the resources, processes, and guidelines for managing these incidents. CompTIA's incident response lifecycle includes seven steps to manage incidents effectively.
In plain words
Supplementary — not from your PDFAn incident is anything that breaks an asset's confidentiality, integrity or availability. CompTIA's incident response lifecycle has seven steps: Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons Learned, and the lessons feed back into preparation.
Detailed explanation
PDF p.296Incident Response Lifecycle
-
1. Preparation
- Function: Makes systems resilient to attacks.
- Actions: Hardening systems, writing policies and procedures, setting up confidential communication lines, and creating incident response resources.
-
2. Detection
- Function: Discovers indicators of threat actor activity.
- Sources: Automated intrusion systems, threat hunting operations, reports from employees, customers, or law enforcement.
-
3. Analysis
- Function: Determines if an incident has occurred and assesses its severity.
- Actions: Triage based on reported indicators.
-
4. Containment
- Function: Limits the scope and impact of the incident.
- Actions: Securing data, notifying stakeholders, and identifying reporting requirements.
-
5. Eradication
- Function: Removes the cause and restores the system to a secure state.
- Actions: Applying secure configurations and installing patches.
-
6. Recovery
- Function: Reintegrates the system into business processes.
- Actions: Restoring data from backups, security testing, and monitoring for reoccurrence.
-
7. Lessons Learned
- Function: Analyzes the incident and response to improve procedures.
- Actions: Documenting the incident and feeding back into the preparation phase.
Important terms
taken from the text above- Sources
- Automated intrusion systems, threat hunting operations, reports from employees, customers, or law enforcement.
Examples & real-world scenarios
Supplementary — not from your PDF- Preparation: writing the IR plan and hardening systems.
- Containment: isolating an infected laptop.
- Lessons learned: updating the phishing playbook after an incident.
Scenario
A team restores an infected server from backup before working out how it was compromised. It's reinfected within a day. Skipping analysis and eradication meant the root cause was still there.
Common mistakes
Supplementary — not from your PDF- Getting the order wrong. Containment comes before eradication, and recovery comes after eradication.
- Treating lessons learned as optional.
Practical skills
Supplementary — not from your PDF- Put the seven IR steps in order and describe each one.
What I should remember
Key Points PDF p.296-
Preparation
- Function: System resilience.
- Actions: Hardening, policies, communication setup.
-
Detection
- Function: Discovering threats.
- Sources: Automated systems, manual detection.
-
Analysis
- Function: Incident confirmation and severity assessment.
- Actions: Triage.
-
Containment
- Function: Limiting impact.
- Actions: Data security, stakeholder notification.
-
Eradication
- Function: Cause removal and system restoration.
- Actions: Secure configurations, patches.
-
Recovery
- Function: System reintegration.
- Actions: Data restoration, monitoring.
-
Lessons Learned
- Function: Procedure improvement.
- Actions: Documentation, feedback.