Incident Response Fundamentals and Frameworks
Why frameworks matter
Incident response (IR) is a disciplined, repeatable process, not improvisation. The core lifecycle you must be able to recite and apply is Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity, commonly associated with NIST SP 800-61. SANS offers a similar PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned). Know that these are models, and questions often test whether you can map a scenario to the correct phase.
Concepts to master
- Incident vs. event vs. vulnerability: an event is any observable occurrence; an incident is an event that actually or potentially harms confidentiality, integrity, or availability.
- CSIRT roles: incident commander, analyst/handler, communications lead, legal, HR, and management sponsor. Separation of duties prevents one person from both investigating and approving.
- Severity/priority matrix: impact × urgency determines escalation, not gut feeling.
- Escalation paths and thresholds: predefined triggers for involving legal, executive, or law enforcement.
Traps in questions
Watch for scenarios that blur containment with eradication (isolating a host does not remove malware) and detection with response (an alert firing is detection; blocking the traffic is response). Another classic trap: assuming law enforcement notification is always required - it is usually a legal/business decision, not a technical one.
Rule of thumb
Name the phase before choosing the action: "What lifecycle stage is this?" If the action stops spread, it is containment; if it removes the root cause, it is eradication; if it restores normal service, it is recovery.