SIRS cheat sheet

Incident: a confirmed or suspected violation of security policy, acceptable use, or law that harms or threatens confidentiality, integrity, or availability of information assets.

Event vs. incident: an event is any observable occurrence in a system or network; only events with confirmed or suspected negative consequence are escalated to incidents.

NIST SP 800-61 lifecycle has four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

SANS six-step model: Preparation; Identification; Containment; Eradication; Recovery; Lessons Learned - containment and eradication are separate steps, unlike NIST.

ISO/IEC 27035 organizes handling into five stages: Prepare; Detect and Report; Assess and Decide; Respond; Learn - with the plan-do-check-act loop as its underlying structure.

CREST and FIRST frameworks add maturity and team-capability dimensions: CSIRT services are commonly classed as reactive (alerts, incident handling), proactive (vulnerability discovery, hardening), and quality/security management.

Incident classification axes: type (malware, DoS, unauthorized access, insider, web compromise), severity/impact, and priority - priority is derived from impact and urgency, not impact alone.

A CSIRT is a defined team with a mandate, constituency, and service catalog; a SOC is a detection-and-monitoring function; the two may be the same people but are distinct roles.

Policy hierarchy: IR policy (management intent and authority) → IR plan (goals, roles, phase procedures) → playbooks/runbooks (per-incident-type steps) → checklists and contact rosters.

Minimum plan contents: purpose and scope, roles and responsibilities, communication paths, escalation criteria, phase procedures, evidence handling, and plan maintenance schedule.

RACI assignment per phase prevents gaps: who is Responsible, Accountable, Consulted, and Informed for detection, containment approval, legal notification, and closure.

A jump kit should include offline media with forensic tools, clean OS images, write blockers, chain-of-custody forms, notebooks, and out-of-band communication devices.

Out-of-band communication (separate phone bridge, secondary email, pre-shared contact cards) must be established before the primary network is assumed untrusted.

Tabletop exercises validate decision-making and communication; functional exercises validate tooling and procedures; both should produce tracked corrective actions.

Pre-negotiated retainers with forensics, legal counsel, PR, and cloud providers reduce time-to-engage; legal counsel should be engaged under privilege where applicable.

Baseline data needed for detection and scoping: asset inventory, network diagrams and data-flow maps, log retention periods, and known-good system images.

Detection sources: IDS/IPS, EDR, SIEM correlation, firewall and proxy logs, DNS logs, authentication logs, DLP, threat intelligence feeds, and user reports.

The triad of affected-entity analysis: precursors (signs an incident may happen) versus indicators (signs an incident may have happened or is happening).

Scoping questions for every alert: what is affected (host, account, data), who is affected (users, customers), how far has it spread, and what is the attack vector.

Pyramid of Pain ranks indicators: hash values and IP addresses are easy for adversaries to change; TTPs are hardest - detection engineering should trend toward TTP-based analytics.

MITRE ATT&CK maps observed behavior to tactics and techniques, giving a shared vocabulary for detection coverage gaps and threat hunting hypotheses.

Alert triage decision rule: true positive → open incident and classify; false positive → tune rule and document; benign true positive → document and close without incident.

Log integrity matters: centralized, time-synchronized (NTP), append-only or WORM storage preserves evidentiary value and enables reliable timeline reconstruction.

Correlation requires a documented timeline: build a chronological record of host, network, and identity events before drawing conclusions about initial access or persistence.

Containment strategy selection criteria: damage potential, evidence preservation needs, service availability, time and resources required, and effectiveness of the chosen strategy.

Isolation options ranked by aggressiveness: monitor-only, network ACL or VLAN isolation, host firewall block, account disable, full host power-off - powering off destroys volatile memory evidence.

When malware is running, capture volatile data (memory image, network connections, running processes) before isolation or shutdown if evidence matters.

Eradication removes the root cause: malware artifacts, malicious accounts, persistence mechanisms, vulnerable software, and attacker-established access - not just the visible symptom.

Recovery criteria: systems rebuilt or cleaned from trusted media, patched to current baseline, credentials rotated, monitoring heightened, and validation testing passed before returning to production.

Re-imaging is preferred over cleaning when the compromise depth is unknown or the system is a high-value asset; cleaning risks leaving undetected persistence.

Time-based containment decision: short-term containment (immediate, reversible) buys time; long-term containment (rebuild, segmentation) is applied once scope is understood.

Eradication is not complete until the initial access vector is identified and closed; otherwise reinfection is likely and the incident will recur.

Post-incident review timing rule: hold the review within about two weeks of closure, while memory is fresh and before corrective actions lose momentum.

The review answers: what happened and when, what worked, what failed, what was the cost, and what changes are required - with named owners and due dates.

Metrics to capture: time to detect, time to contain, time to eradicate, dwell time, number of affected assets and records, and cost (response, downtime, legal, notification).

Root-cause analysis techniques: 5 Whys, Ishikawa/fishbone, and fault-tree analysis; distinguish proximate cause (the alert) from systemic cause (the missing control).

Evidence retention rule: keep incident records per legal, regulatory, and contractual requirements - often years - and store them so they remain admissible and retrievable.

Corrective actions must be tracked in the risk register or ticketing system with owners and deadlines; unclosed actions are the most common failure of the lessons-learned phase.

Lessons learned feed back into Preparation: update playbooks, detection rules, training, and the asset inventory, closing the lifecycle loop.

Benchmarking against frameworks (NIST CSF tiers, CMMI-style maturity levels) turns individual incidents into measurable program improvement.

Communication plan elements: who communicates, to whom, through which channel, with what approval authority, and at what cadence (e.g., initial notice within 1 hour, updates every 4 hours).

Stakeholder tiers: internal (executives, IT, legal, HR, PR), external (customers, regulators, law enforcement, media, partners) - each with a distinct message and approval path.

Single point of contact and single voice rule: one designated spokesperson prevents contradictory statements that create legal and reputational exposure.

Status reporting structure: situation summary, impact, actions taken, actions planned, decisions needed, and next update time - keep it factual and free of speculation.

Law enforcement engagement is a management decision weighed against investigation support, subpoena power, disclosure risk, and business disruption.

Regulator and customer notifications must be coordinated with legal counsel; premature disclosure can waive privilege or trigger contractual breaches.

Internal coordination requires a shared incident log or war-room channel of record so decisions and timestamps are auditable.

Media and public statements should be pre-drafted templates held by communications, reviewed by legal, and never released without incident-commander sign-off.

Chain of custody: every transfer of evidence is documented with who, what, when, where, and why; a broken chain can render evidence inadmissible or non-defensible.

Evidence handling rules: use write blockers for disk imaging, hash images (SHA-256) at acquisition and verify at analysis, and store originals in a controlled evidence locker.

Order of volatility: collect CPU registers and cache, then memory, then network state, then disk, then backups and archival media - capture the most perishable first.

GDPR breach notification: notify the supervisory authority within 72 hours of becoming aware where a personal-data breach is likely to result in risk to rights and freedoms.

US state breach laws and sector rules (HIPAA, GLBA, PCI DSS) impose differing thresholds, timelines, and content requirements; the strictest applicable rule governs.

Privilege protection: route forensic work and incident analysis through outside counsel to strengthen attorney-client privilege and work-product protection.

Ethical duties: minimize harm, preserve privacy, avoid unauthorized access beyond the scope of the investigation, and disclose conflicts of interest.

Data minimization during investigation: collect only what is necessary, restrict access on a need-to-know basis, and document lawful authority for monitoring employee systems.