Incident Response: Phases, Decisions, and Communication
The lifecycle
Incident response follows a repeatable lifecycle: preparation, identification, containment, eradication, recovery, and lessons learned. Know that containment has short-term and long-term options, and that the decision to isolate a host trades evidence preservation and business impact against attacker spread. Eradication removes the root cause; recovery restores operations with monitoring; lessons learned produces durable improvements.
Roles and frameworks
Understand the roles: incident commander, analyst, communications lead, legal, and management. Frameworks like NIST SP 800-61 provide the canonical phases, and playbooks make response repeatable. Know the difference between an event, an alert, and an incident, and when escalation is warranted. Understand evidence handling during response, and that containment actions can destroy volatile evidence if taken carelessly.
Traps and a worked example
Traps: jumping to eradication before scoping (you miss additional compromised hosts); wiping and rebuilding before collecting evidence; confusing containment with eradication; and neglecting communication and regulatory notification timelines. Also watch for questions that assume you should always isolate immediately, even when the host is a critical server and a targeted block is safer.
Worked example: a workstation shows C2 beaconing. Identify and scope: check proxy and DNS logs for other hosts contacting the same infrastructure. Short-term containment: block the destination at the perimeter and isolate the host from the network while keeping it powered for memory capture. Eradicate: remove persistence and reimage. Recover: restore with enhanced monitoring. Lessons learned: add a detection rule for the beacon pattern. Rule of thumb: scope before you contain, contain before you eradicate, and preserve evidence before you rebuild.