Security + Domain 4 Incident Response & Forensics

analysis

checking logs, alerts, and data to find out what happened

Containment

Stopping the threat from spreading or doing more damage.

Eradication

Removing the threat completely from the system.

Recovery

Getting systems back to normal and making sure the threat is gone.

Post-Incident Activity / Lessons Learned

Review what happened, what was done, and how to improve for next time.

Root Cause Analysis

Finding the main reason why a problem or incident happened.

After Action Report

A summary of what happened, what was done, and how to improve.

Threat Hunting

Searching your systems for hidden attackers before they cause harm.

Profiling Threat Actors and Activities

Learning about hackers and what they usually do to better predict and stop attacks.

Advisories and Bulletins

Official alerts that warn about security problems and how to fix them.

Intelligence Fusion and Threat Data

Combining info from many sources to get a clear picture of threats.

testing

exercise of incident response procedures

tabletop exercise (ttx)

simulate incidents within a control framework

Penetration Test

A safe, planned cyberattack used to find weaknesses before real attackers do.

simulation

practice run of a cyberattack or incident to test how people and systems respond.

digital forensics

process of collecting, analyzing, and preserving electronic evidence

Identification

The process of claiming an identity, usually with a username or ID, before authentication happens.

Collection

The process of gathering digital evidence from systems, devices, or networks in a secure way for analysis.

Order of Volatility

The order in which digital evidence should be collected, from most to least temporary.

Chain of Custody

record of who collected, handled, and stored digital evidence

Disk Imaging

Creating an exact copy of a storage device for forensic analysis without altering the original data.

File Carving

recovering files from raw data on a disk without using the file system.

Legal Hold

A process that preserves all relevant data to prevent deletion during an investigation or legal case.

Electronic Discovery (eDiscovery)

process of identifying, collecting, and producing electronic data for use in legal cases or investigations.

Data Acquisition

collecting digital evidence from devices in a forensically sound way for analysis.