CRIE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Incident vs event

An event is any observable occurrence in a system or network. An incident is an event that actually or potentially harms confidentiality, integrity, or availability, warranting a response.

NIST IR lifecycle

Four phases from SP 800-61: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Phases may overlap and iterate during a single incident.

Incident severity scoring

Severity is derived from functional impact on business operations, information impact such as data breach, and recoverability effort. These dimensions are assessed separately rather than as a single gut call.

Framework vs playbook

A framework defines governance, phases, and roles across all incident types. A playbook gives step-by-step procedures for one specific scenario, such as ransomware or business email compromise.

CSIRT role separation

The incident commander directs strategy and decisions, the technical lead runs investigation, communications handles messaging, and a liaison coordinates stakeholders. Separation preserves span of control under pressure.

Tabletop exercise purpose

A discussion-based exercise that tests decision-making, escalation, and communication paths without touching production systems. It reveals ambiguity in roles and authorities before a real incident occurs.

Out-of-band communication

A communication channel independent of the primary corporate email or chat, used when those systems may be compromised or unavailable. It must be established and tested during preparation.

Jump bag contents

Pre-staged response equipment: forensic workstation, write blockers, imaging media, clean credentials, network taps, and documentation forms. Its purpose is to eliminate acquisition delays during an incident.

Emergency change authority

Pre-approved authority to make urgent configuration or infrastructure changes during an incident, bypassing routine change-control queues. It shortens containment time while retaining an audit trail.

Log retention versus dwell time

Retention periods must exceed expected attacker dwell time. If logs roll off before compromise is discovered, scoping and timeline reconstruction become impossible.

Indicator of compromise

A host or network artifact such as a file hash, domain, IP address, or registry key associated with known malicious activity. It is observable evidence, not a behavior pattern.

Indicator of attack

A behavioral pattern reflecting attacker intent and methodology, such as credential dumping or lateral movement. It is more durable than static artifacts because it describes technique rather than tooling.

Pyramid of Pain

A model ranking indicators by the cost an adversary incurs when they must change them. Hashes are easiest to change; tactics, techniques, and procedures are hardest.

Alert fidelity

The ratio of true positives to total alerts for a detection. Low fidelity produces analyst fatigue and missed signals; tuning trades sensitivity against noise.

Patient zero scoping

Determining the initially compromised host, then expanding scope outward through shared credentials, lateral movement paths, and common tooling. Scope drives containment breadth.

Triage questions

Core detection questions: is the alert a true positive, what is the affected scope, what is the business impact, and who must be notified. Answers determine escalation.

Short-term containment

Immediate action to stop spread, such as network isolation or account disablement. It is temporary and designed to buy time for a fuller containment and eradication strategy.

Long-term containment

Stabilizing the environment after spread is stopped, allowing eradication and recovery to proceed. It may involve rebuilt segments, temporary monitoring, and controlled access while remediation continues.

Isolation versus shutdown

Isolating a host from the network preserves volatile memory for forensics while stopping spread. Shutting it down stops activity but destroys RAM-resident evidence.

Order of volatility

RFC 3227 collection priority: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media. Collect the most perishable evidence first.

Eradication scope

Eradication removes the root cause: malware, persistence mechanisms, vulnerable services, and compromised accounts. Removing only symptoms leaves the intrusion capable of recurrence.

Recovery validation criteria

Conditions that must be met before restoring service: clean scans, verified backup integrity, restored configurations, and a monitored stability period with business sign-off.

Chain of custody

A documented record of who handled evidence, when, where, and for what purpose. Any unrecorded gap weakens the evidence's integrity and admissibility.

Write blocker function

A hardware or software device that prevents write operations to source media during acquisition. It preserves original evidence integrity while a forensic image is created.

Forensic image versus logical copy

A forensic image is a bit-for-bit duplicate including slack and unallocated space. A logical copy captures only files and loses deleted data and file system metadata.

Timestomping

An attacker technique that alters file system timestamps to hide activity. Analysts corroborate timestamps against other artifacts such as event logs and USN journal entries.

Volatile artifacts

Data lost on power-down: running processes, network connections, logged-on users, loaded drivers, and RAM-resident malware. They are captured before shutdown whenever feasible.

Evidence integrity hashing

Computing a cryptographic hash such as SHA-256 of source media and the acquired image. Matching hashes demonstrate the copy is unaltered.

Communication cadence

A defined schedule for status updates stating confirmed facts, current actions, and the next update time. Predictable cadence prevents rumor and repeated ad hoc inquiries.

Single source of truth

One incident log or ticket that records all actions and findings. It prevents conflicting narratives across teams and supports later timeline reconstruction and reporting.

Executive incident reporting

Reporting focused on business impact, risk exposure, and decisions required, rather than technical detail. Executives need actionable choices, not packet captures.

Lessons learned timing

A post-incident review held within days of recovery while participant memory is fresh. Delayed reviews lose detail and reduce the value of corrective actions.