Incident Response and Recovery
What to know
Incident response is a lifecycle, not an event. Know the phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Understand the difference between containment strategies: isolating hosts, blocking accounts, segmenting networks, and the tradeoff between stopping spread and preserving evidence. Know evidence handling basics: chain of custody, order of volatility, and when to involve legal and law enforcement.
Know the incident classification and escalation model, severity criteria, and who declares an incident. Understand communications: internal escalation, executive briefing, customer and regulator notification timelines, and the role of legal counsel. Recovery concepts tie back to BIA: RTO, RPO, backups, immutable and offline copies, and tested restoration. Tabletop exercises and playbooks demonstrate readiness. Also know the distinction between an event, an incident, and a breach, and how disaster recovery differs from business continuity.
Traps
- Wiping and rebuilding before capturing volatile evidence.
- Treating containment as eradication; the root cause must be removed.
- Assuming backups are recoverable without restoration testing.
- Missing notification obligations because legal was engaged too late.
Worked example / rule of thumb
A workstation shows beaconing. Correct sequence: preserve volatile evidence, isolate the host at the network layer, scope other hosts via logs, eradicate persistence, restore from known-good images, then run lessons learned. Rule of thumb: contain first, eradicate second, recover third, and document throughout.