Incident Response Process

An incident is an event that actually or potentially harms the confidentiality, integrity or availability of information or systems (see CIA Triad). Incident response (IR) is the organised approach to handling one so that damage and recovery time are minimised and the organisation learns from it. Panic-driven improvisation is the main thing a process prevents.

This page covers the process. For the legal kinds of investigation (criminal, civil, regulatory, administrative) see Investigation Types; for evidence work see Digital Forensics.

NIST SP 800-61 Lifecycle

 +-------------+     +-----------------+     +------------------------------+     +----------------+
 | Preparation | --> | Detection &     | --> | Containment, Eradication &   | --> | Post-Incident  |
 |             |     | Analysis        |     | Recovery                     |     | Activity       |
 +-------------+     +-----------------+     +------------------------------+     +----------------+
        ^                                                                                  |
        +----------------------------- lessons learned ------------------------------------+

The cycle is not strictly linear: analysis continues during containment, and new findings often send the team back a step.

Preparation

• IR policy: authority, scope and definitions approved by management.
• IR plan: the roadmap - roles, communication paths, severity levels, escalation.
• IR team (CSIRT): incident manager, analysts, forensic specialists, IT/network/system owners, plus legal, HR, communications and management as needed.
• Tools and access: logging/SIEM (SIEM and Log Management), EDR, forensic kit, secure out-of-band communication, clean jump hosts.
• Hardening and backups that reduce impact: see System Hardening.
• Exercises: tabletop and live drills so the first real incident is not the first rehearsal.

Playbooks and runbooks

Typical playbooks: phishing, ransomware, compromised account, malware outbreak, data leak, DDoS.

Detection and Analysis

Sources: SIEM and EDR alerts, user reports, threat intelligence, third-party notification. The SOC usually does first triage.

Key tasks: validate (is it real?), determine scope (which hosts, accounts, data), establish a timeline, identify the entry point, and record everything. Preserve evidence early.

Severity and classification

Base severity on business impact, data classification (Asset Classification) and spread, not on technical curiosity. Define your own scale in the plan.

Common incident types

Malware and ransomware, phishing and business email compromise, account compromise, web application attack, denial of service, insider misuse, data loss/exfiltration, lost or stolen device, unauthorised access.

Containment, Eradication and Recovery

Containment

Before containing, decide whether to capture memory and disk first (see Digital Forensics). Choose containment by business impact: sometimes watching an attacker briefly yields better scoping, sometimes immediate isolation is the only option.

Eradication

Remove the root cause: malware, persistence mechanisms, rogue accounts, exploited vulnerabilities (see Vulnerability and Patch Management). Reset credentials that may have been exposed.

Recovery

Restore from known-good backups or rebuild, return systems to production in stages, and monitor closely for re-compromise. Verify integrity before reconnecting.

Communication and Escalation

• Internal: incident manager updates management on a fixed cadence; need-to-know basis; use a channel the attacker cannot read if accounts may be compromised.
• Legal and compliance: involve early. Many laws require notifying regulators and affected individuals within a set time after a personal-data breach; see GDPR. Check which laws and contracts apply to you.
• PR / communications: a single spokesperson; no speculation.
• External: law enforcement, insurers, customers, vendors, and CERTs as appropriate.
• Document decisions, with times, for later review.

Post-Incident Activity

Hold a blameless review soon after recovery.

Incident summary:    what happened, when, impact
Timeline:            detection, escalation, containment, recovery (with times)
Root cause:          how the attacker got in / what failed
What went well:
What went poorly:
Metrics:             time to detect, time to contain, time to recover
Action items:        owner + due date for each (detection, process, tooling, training)

Update playbooks, detections and controls; track action items to completion, otherwise the lesson is not learned.

Key Points

• NIST: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity; SANS splits the middle into more steps.
• Preparation determines how well everything else goes.
• Classify by business impact; contain, then eradicate the root cause, then recover.
• Involve legal early; breach-notification clocks can start at discovery.
• The review is where the value is.

Hands-on

• Incident Response Fundamentals - incident types, process, techniques, lab

Related

• Investigation Types
• Digital Forensics
• Security Operations Center
• Business Continuity
• Security Policy