Incident Response, Forensics, and Recovery

What is a security incident?

An event or series of events involving a security policy violation that adversely affects normal business operations.

What is incident response?

Actions taken during and after an incident to stabilize, investigate, recover, document, and improve.

What are the six phases of incident response?

Preparation → Detection & Analysis → Containment → Eradication → Recovery → Documentation & After-Incident Review.

What is the purpose of the preparation phase?

Establish procedures, roles, training, tools, and tested backups before an incident occurs.

What are the three main responsibilities of a first responder?

Stabilize, assess, and escalate.

What does stabilizing an incident involve?

Observing activity, avoiding unnecessary changes, and preventing immediate additional harm.

What is a preliminary damage assessment?

Identifying which systems, data, users, or services appear affected.

Why should first responders avoid rushing to fix a system?

Unnecessary changes may destroy evidence, hide the original cause, or complicate recovery.

What is the purpose of detection and analysis?

Confirm whether an incident occurred, determine its scope and impact, and identify important evidence.

What three areas should responders examine during detection and analysis?

Confirmation, scope, and impact.

What is live analysis?

Examining a running system's network connections, memory contents, and active programs.

What is dead analysis?

Examining stored data, such as hard-drive contents, after a system is no longer actively running.

What is big data analysis in incident response?

Examining large amounts of organizational data, such as logs, text, audio, and video, to identify patterns or anomalies.

When is live analysis especially useful?

When important information could disappear if the system is powered down.

What is corroborative evidence?

Information that supports or confirms another fact or detail.

What is hearsay evidence?

Information from someone without direct, firsthand knowledge of the event.

Why must responders distinguish facts from assumptions?

To make defensible decisions based on reliable evidence rather than unverified claims.

What is containment?

Limiting malicious activity, interaction, and spread while the organization prepares further response.

What is quarantine?

Separating a suspicious or malicious file or application so it cannot interact with the environment.

What is device isolation?

Disconnecting a compromised device from the network to prevent further interaction or spread.

What is the difference between quarantine, isolation, and containment?

Quarantine separates files or applications; isolation disconnects devices; containment limits the wider incident.

What is eradication?

Removing the malicious cause and addressing what allowed the incident to persist.

What is the difference between containment and eradication?

Containment stops the problem from spreading; eradication removes its cause.

What is the purpose of recovery?

Restore data, systems, and business operations to a trusted working state.

What should be verified before restoring systems?

That the threat has been addressed and backups, configurations, and restored systems can be trusted.

What are the risks of restoring systems too quickly?

Reinfection, repeated compromise, lost evidence, and additional outages.

What are the risks of delaying recovery unnecessarily?

Extended business disruption and unnecessary operational impact.

What is a balanced recovery strategy?

Restore high-priority trusted services first, validate backups and systems, and monitor closely.

What should incident documentation include?

A timeline, affected systems and data, key decisions, response actions, and evidence collected.

What is the purpose of an after-incident review?

Identify what worked, what failed, and how procedures, controls, and training can improve.

What is a runbook?

A collection of routine operational procedures used by network administrators.

What is a playbook?

Documented steps responders follow when a particular security event is detected.

What is the difference between a runbook and a playbook?

A runbook guides routine operations; a playbook guides responses to detected events.

What is whitelisting?

Allowing only applications included on an approved list.

What is blacklisting?

Blocking applications or activities known to be malicious.

What four first-responder tools are highlighted in the notes?

Network monitoring, network baselines, screenshot tools, and tested backups.

What is the purpose of a network baseline?

To compare current network activity against expected normal behavior.

A malicious file is detected on an otherwise normal workstation. What is the best next concept?

Quarantine the file or application.

A workstation is confirmed compromised and communicating unexpectedly. What is the best next concept?

Isolate the device from the network.

What is the recommended response sequence for a spreading incident?

Contain → Understand → Remove → Recover, followed by documentation and review.