Incident Response (DONE)

Incident

An act that violates a security policy

Incident Response

Systematic approach to managing and mitigating security incidents to minimize impact and speed recovery

NIST Incident Response Phases

NIST (National Institute of Standards and Technology) is a US government agency that publishes widely used standards and guidelines, including cybersecurity frameworks.

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity

CompTIA Incident Response Phases

Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-Incident Activity (7 phases)

Preparation

Getting ready before incidents: hardening systems and creating policies, procedures, and a communication plan

Detection

Determining whether a security incident has occurred; triage analysts assess severity

Analysis

Examining the incident's scope and impact, notifying stakeholders, and starting containment

Containment

Limiting the incident's scope and preventing the spread of malicious activity

Eradication

Removing malicious activity from systems, possibly by reimaging

Recovery

Restoring systems to a secure state with backups, patches, and updated configurations

Post-Incident Activity

Root cause analysis, lessons learned, and an after-action report to prevent future incidents

Lessons Learned

Formally documenting experiences from an incident to improve future response

After-Action Report

Formal record of what happened during an incident

Incident Response Team Roles

Leader, subject matter experts, IT support, legal counsel, HR, and public relations

Outsourcing Incident Response

Using external specialists; effective but expensive and less familiar with your network

Threat Hunting

Proactively searching for threats that normal monitoring hasn't detected

Threat Hunting Hypothesis

Using threat modeling and intelligence to guess which threats may target you

Intelligence Fusion

Combining SIEM logs with external threat feeds during threat hunting

SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across a network to detect and alert on security threats.

Root Cause Analysis (RCA)

Identifying the initial source of an incident to prevent recurrence

RCA (root cause analysis ) Steps

Define and scope the incident, determine causal relationships, identify solutions, implement and track solutions

No-Blame Approach

RCA (root cause analysis) focuses on fixing systemic issues rather than blaming individuals

Incident Response Training

Role-tailored education on IR (Incident Response) processes for responders, managers, executives, and end users

Tabletop Exercise (TTX)

Discussion-based exercise where participants talk through an incident scenario; cheap but not hands-on

Penetration Test (IR Testing)

Red team attempts intrusion based on a threat scenario with set rules of engagement

Pentest Tools

Metasploit, Cobalt Strike, Kali Linux, ParrotOS, Commando OS

Simulation

Realistic, hands-on scenario mimicking a real incident (phishing, ransomware, multi-stage attacks)

Digital Forensics

Investigating digital devices and data to uncover evidence for legal purposes

Forensic Phases

Identification, collection, analysis, and reporting

Identification (Forensics)

Securing the scene, preventing contamination, and finding where relevant data is stored

Collection (Forensics)

Gathering evidence with proper authorization, following the order of volatility

Order of Volatility

Collect the most volatile data first (CPU registers/cache, RAM) and least volatile last (archival data)

Order of Volatility (Full List)

CPU registers/cache → RAM, routing/ARP tables, process table, swap → mass storage → remote logs → physical config/topology → archival data

Chain of Custody

Documented record tracking who handled evidence from collection until it's presented in court

Disk Imaging

Bit-by-bit copy of a storage device, including deleted files and unallocated space

File Carving

Extracting files and fragments from storage without relying on the file system

Analysis (Forensics)

Examining a forensically sound copy for relevant data, timestamps, and user activity

Reporting (Forensics)

Final report documenting methods, tools, actions, findings, and conclusions; may be used in court

Legal Hold

Order to preserve relevant electronic data when litigation is expected

E-Discovery

Identifying, collecting, and presenting electronically stored information for legal proceedings

Forensic Ethics

Avoid bias, use repeatable actions, and preserve evidence (analyze an image, not the original)

Data Acquisition

Creating a forensically sound copy of data from a source like memory or a hard disk

FTK (forensic tool kit )and EnCase

Popular digital forensics analysis tools

Memory-Only Registry Keys

Some Windows keys (like HKLM\Hardware) exist only in RAM and need a memory dump

HKLM = HKEY_LOCAL_MACHINE (a main branch of the Windows Registry holding system-wide settings)