Incident Response, Business Continuity, and Security Documentation

Vocabulary flashcards covering cybersecurity incident response lifecycle phases, post-incident activities, business continuity planning, recovery sites, and documentation best practices.

NIST Incident Response Lifecycle

A cyclical process model for handling incidents consisting of four key phases: Preparation; Detection & Analysis; Containment, Eradication & Recovery; and Post-Incident Activity.

Analysis

The investigation and validation of alerts.

Broken chain of custody

Inconsistencies in the collection and logging of evidence in the chain of custody.

Chain of custody

The process of documenting evidence possession and control during an incident lifecycle.

Business continuity plan (BCP)

A document that outlines the procedures to sustain business operations during and after a significant disruption.

Disaster recovery plan

A plan used to recover information systems in response to a major disaster, ranging from hardware failure to the destruction of facilities from a natural disaster like a flood.

Containment

The act of limiting and preventing additional damage caused by an incident.

Eradication

The complete removal of the incident elements from all affected systems.

Recovery

The process of returning affected systems back to normal operations.

Post-incident activity

The process of reviewing an incident to identify areas for improvement during incident handling.

Lessons learned meeting

A meeting (also known as a post-mortem) that includes all involved parties after a major incident to evaluate the response actions and identify areas of improvement without assigning blame, scheduled no later than two weeks after remediation.

5 W's of incident investigation

The minimum details that incident response documentation should describe about an incident: who, what, where, why, and when.

Final report

Documentation that provides a comprehensive review of an incident at the end of the incident lifecycle.

Executive summary

A high-level summary of the final report that includes the key findings and essential facts related to the incident.

Timeline

A detailed chronological section of a final report that includes timestamps dating the sequence of events that led to the incident.

Detection

The prompt discovery of security events.

Documentation

Any form of recorded content that is used for a specific purpose.

Three benefits of documentation

Transparency, standardization, and clarity.

Crowdsourcing

The practice of gathering information using public input and collaboration.

Honeypot

A system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders.

Incident response plan

A document that outlines the procedures to take in each step of incident response.

Indicators of attack (IoA)

The series of observed events that indicate a real-time incident.

Indicators of compromise (IoC)

Observable evidence that suggests signs of a potential security incident.

Intrusion detection system (IDS)

An application that monitors system activity and alerts on possible intrusions.

Open-source intelligence (OSINT)

The collection and analysis of information from publicly available sources to generate usable intelligence.

Playbook

A manual that provides details about any operational action.

Resilience

The ability to prepare for, respond to, and recover from disruptions.

Site resilience

A recovery strategy used to ensure the availability of networks, data centers, or other infrastructure when a disruption happens.

Hot site

A fully operational facility that is a duplicate of an organization's primary environment and can be activated immediately when an organization's primary site experiences failure or disruption.

Warm site

A facility that contains a fully updated and configured version of the hot site; not fully operational for immediate use, but can quickly be made operational when disruption occurs.

Cold site

A backup facility equipped with some of the necessary infrastructure required to operate an organization's site, which might not be ready for immediate use and requires additional work.

Standards

References that inform how to set policies.

Threat hunting

The proactive search for threats on a network.

Threat intelligence

Evidence-based threat information that provides context about existing or emerging threats.

Triage

The prioritizing of incidents according to their level of importance or urgency.

VirusTotal

A service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content.