Incident Response and Breach Notification
What to know
Incident response follows a lifecycle: prepare, detect and analyze, contain, eradicate, recover, and learn. Candidates must distinguish an event (observable occurrence) from an incident (confirmed adverse event requiring response) and a breach (incident involving unauthorized access to or disclosure of protected data). Know the roles: incident commander, communications, legal, forensics. Understand evidence handling - chain of custody, order of volatility, hashing of images - and the tension between containment and preservation. Breach notification obligations differ by regime: regulators, affected individuals, and sometimes law enforcement or partners, each with distinct triggers and timelines.
Traps
The biggest trap is notifying too early or too late: notification is triggered by confirmed risk, not by suspicion. Another is destroying evidence by rebooting or wiping a host before capture. Be careful with "containment" chosen when the scenario requires "eradication" or "recovery." Also, contractual notification duties to customers may be shorter than statutory ones.
Worked example / rule of thumb
Ransomware is detected on a file server. Preserve volatile evidence, isolate the host (containment), remove the malware and patch the entry point (eradication), restore from clean backups (recovery), then conduct a lessons-learned review. In parallel, legal assesses whether personal data was exfiltrated to determine notification duties. Rule of thumb: contain first, but capture before you wipe; notify only when the facts support the legal threshold.
Exam focus
Expect sequencing questions and notification-threshold questions across multiple regimes.