4.8a incident response lifecycle · TXT

NIST SP 800-61 Rev. 2

The Computer Security Incident Handling Guide, the formal framework for the incident response lifecycle.

Incident response lifecycle

Preparation, then Detection and Analysis, then Containment/Eradication/Recovery, then Post-Incident Activity. A loop, not a straight line.

Preparation (IR phase)

Pre-incident planning: contact lists, incident go-bag, documentation, baselines, file hashes, known-good images, policies and procedures.

Incident go-bag

Pre-assembled kit of hardware and software for incident response: specialized laptops, removable media, forensic software, digital imaging tools.

Known-good baseline/image

Reference copies of clean OS and application software plus file hashes, used to identify what's changed and to restore compromised systems.

Detection and analysis (IR phase)

Identifying that an incident has occurred, using log review, IPS alerts, antivirus reports, configuration change monitoring, and traffic volume anomalies.

Attack traffic ambiguity

Distinguishing a legitimate breach from routine internet background noise, like automated scanning attempts, can be genuinely difficult.

Sandbox (IR detection use)

Isolated environment used to safely execute suspected malware and observe its behavior without risking production systems.

Sandbox evasion

Some malware detects it's running in a sandboxed or virtualized environment with limited connectivity and deliberately deletes itself to avoid analysis.

Containment

Stopping the incident from spreading further, e.g. isolating affected systems.

Eradication

Removing the actual malicious cause: deleting malware, closing the vulnerability that allowed entry.

Recovery (IR phase)

Restoring affected systems back to normal operation via reimaging or restoring from known-good backups.

Containment, eradication, recovery

NIST groups these three as one combined phase, though they are distinct steps: stop the spread, remove the cause, restore normal operation.

Post-incident activity / lessons learned meeting

Held soon after resolution while memory is fresh; reviews what happened, the timeline, how well the plan worked, and what to change going forward.

Missed indicators review

Post-incident analysis specifically checks whether warning signs were missed, informing future monitoring adjustments.

Pre-incident training requirement

All IR training and documentation must happen before an incident occurs; there is no time for on-the-job learning during a live incident.

Post-incident meeting timing

Should happen as soon as possible after resolution, since participants' memory of details fades quickly.