Six-Step Incident Response Process

Six-Step Incident Response Process

What does PICERL stand for?

Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.

How many phases are in the classic PICERL model?

Six.

What is the first phase of PICERL?

Preparation.

What happens in the Preparation phase?

Policies, procedures, monitoring, and security safeguards are established before an incident.

What is the second PICERL phase?

Identification.

What is another name for Identification?

Detection.

What can trigger incident identification?

A help-desk report, IDS alert, or administrator observation.

What is the third PICERL phase?

Containment.

What is the main goal of Containment?

Limit an incident’s impact and prevent further attacker activity.

What is an example of containment for a defaced website?

Taking the website offline when feasible.

What are the two containment horizons described in PICERL?

Short-term containment and longer-term containment.

What may occur between short-term and long-term containment?

Evidence collection.

Why might longer-term containment wait until evidence collection?

More invasive actions can disrupt or destroy evidence.

What is the fourth PICERL phase?

Eradication.

What is the goal of Eradication?

Undo damage and remove attacker activity from the environment.

What are examples of eradication actions?

Removing malicious data, killing attacker processes, and changing passwords.

Which phase includes changing compromised passwords?

Eradication.

What is the fifth PICERL phase?

Recovery.

What is the primary goal of Recovery?

Restore business systems and operations.

What is the final PICERL phase?

Lessons Learned.

What happens during Lessons Learned?

Write the final report and fix exploited vulnerabilities.

How does NIST SP 800-61 differ from PICERL in grouping phases?

It groups containment, eradication, and recovery into one major step.

What is a common Preparation failure?

Poor security hygiene and insufficient visibility.

Which foundational security practices does the book cite as often poorly implemented?

Least privilege and strong passwords.

What monitoring gaps weaken preparation?

Missing network monitoring, log aggregation, and activity auditing.

What intelligence capability do organizations often underuse?

Threat intelligence.

What is the biggest problem with incident scoping?

Not performing it.

Why is investigating only known compromised hosts insufficient?

Other compromised systems may remain undiscovered.

What minimum scoping action does the book recommend?

Scan the enterprise for relevant indicators of compromise.

What does IOC stand for?

Indicator of compromise.

What common containment error does the book highlight?

Skipping containment entirely.

Why can immediately killing malicious processes hurt an investigation?

It can prevent collection of vital evidence.

How does weak scoping undermine containment?

Responders do not know all the systems attackers reached.

What can result from incomplete eradication?

Attackers persist in the environment.

Which PICERL stage may receive more attention because executives notice business downtime?

Recovery.

What is the recurring Lessons Learned failure?

Not identifying or fixing the root cause.

What root-cause question should follow a weak-password compromise?

Why was the weak password allowed and what control failed?

What deeper weakness does the course identify in classic incident response?

A linear, static approach.

How are Containment and Eradication different?

Containment limits spread; eradication removes attacker activity and damage.

How are Eradication and Recovery different?

Eradication removes the threat; recovery restores business operations.