Lesson 12 - Group 1: Incident Response

What is the incident-response process order shown on page 4?

Preparation, detection, analysis, containment, eradication, recovery, and lessons learned.

Preparation

Establishing the cybersecurity infrastructure, personnel, plans, communication methods, and authority needed to respond to incidents.

Cyber Incident Response Team

The group responsible for reporting, categorizing, prioritizing, analyzing, and responding to incidents; related names include CIRT, CERT, CSIRT, and SOC.

Triage

Reporting, categorizing, and prioritizing reported security events and incidents.

What nontechnical roles may participate in incident response?

Management, legal, Human Resources, and marketing.

Communication plan

Defines trusted contacts, stakeholder communications, notification procedures, and how incident information should be shared.

Why should incident information be shared on a need-to-know basis?

To prevent inadvertent disclosure of sensitive incident information.

Out-of-band communication

Communication through a separate channel to avoid alerting an intruder who may be monitoring normal systems.

IRP

Incident Response Plan.

Detection

Identifying possible incidents through logs, alerts, baseline deviations, manual inspection, notifications, public reporting, or whistleblowing.

First responder

The CIRT member who takes charge of a reported incident.

Analysis

Classifying, prioritizing, and determining an incident’s impact, scope, category, detection time, and expected recovery time.

Playbook

A documented set of response actions for a particular incident type or scenario.

Containment

Limiting incident damage while considering loss control, available countermeasures, and evidence preservation.

Isolation-based versus segmentation-based containment

Isolation removes an affected system from other systems; segmentation restricts communication between network areas.

Eradication and recovery

Reconstituting affected systems, reaудiting security controls, restoring operations, and notifying affected parties.

Lessons learned

A post-incident process that reviews the timeline, reports findings, and identifies improvements.

Five whys

A root-cause analysis method that repeatedly asks why an incident or failure occurred.

What testing methods are listed for incident response?

Tabletop exercises, walkthroughs, and simulations.

Tabletop versus walkthrough versus simulation

A tabletop discusses a facilitator-provided scenario without live systems; a walkthrough demonstrates response actions; a simulation uses a simulated intrusion, such as one performed by a red team.

Threat hunting

A proactive process that uses threat intelligence and security data to search for threats before or outside normal reactive incident respons