SIRS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Incident response lifecycle

The repeating set of phases a team follows to prepare for, detect, contain, eradicate, and learn from security incidents, typically modeled on NIST SP 800-61 or ISO/IEC 27035.

Event versus incident

An event is any observable occurrence in a system or network; an incident is an event, or series of events, that actually or potentially harms confidentiality, integrity, or availability.

NIST SP 800-61 phases

Four-phase lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. It is the most widely referenced public incident response framework.

SANS six-step model

Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Unlike NIST, it treats containment and eradication as separate phases and places lessons learned last.

Incident severity classification

Assigning a level such as low, medium, high, or critical based on business impact and urgency, which determines escalation path, notification duties, and resource allocation.

CSIRT services

A computer security incident response team's catalog of reactive services (alerts, incident handling), proactive services (hardening, vulnerability discovery), and quality or security management services.

IR policy versus plan

The policy states management intent, authority, and scope; the plan translates it into roles, phase procedures, communication paths, and escalation criteria that staff actually execute.

Incident response playbook

A per-incident-type procedure, such as ransomware or phishing, listing ordered steps, decision points, required tools, and escalation contacts so responders act consistently under pressure.

Jump kit contents

A pre-packed response kit holding offline forensic tools, clean OS media, write blockers, chain-of-custody forms, notebooks, and out-of-band communication devices for field response.

Out-of-band communication

A pre-established channel independent of the compromised network, such as a phone bridge or secondary email, so responders can coordinate when primary systems are untrusted.

Tabletop exercise

A discussion-based simulation in which participants walk through a scenario and make decisions, validating communication paths, roles, and the plan without touching production systems.

RACI matrix

A responsibility assignment chart marking who is Responsible, Accountable, Consulted, and Informed for each activity, preventing ownership gaps across response phases.

Indicator of compromise

Observable forensic evidence, such as a file hash, IP address, domain, or registry key, suggesting a system has been compromised or an intrusion is underway.

Pyramid of Pain

A model ranking indicators by how much difficulty they cause an adversary to change: hashes and IPs are easy, while tools and tactics, techniques, and procedures are hard.

MITRE ATT&CK

A curated knowledge base of adversary tactics and techniques observed in real intrusions, used to map detection coverage, structure threat hunting, and describe attacker behavior consistently.

Alert triage

The process of quickly assessing an alert to decide whether it is a true positive requiring an incident, a false positive needing rule tuning, or a benign event closed with documentation.

Incident timeline reconstruction

Building a chronological record of host, network, identity, and application events from multiple log sources to establish initial access, scope, and attacker actions.

Log integrity and time sync

Centralizing logs, synchronizing clocks with NTP, and storing them append-only or write-once preserves evidentiary value and makes cross-source correlation reliable.

Containment strategy selection

Choosing an isolation approach by weighing damage potential, evidence preservation needs, service availability, time and resources required, and the strategy's likely effectiveness.

Short-term versus long-term containment

Short-term containment is immediate and reversible, buying time to scope the incident; long-term containment involves rebuilding, segmentation, and durable fixes once scope is known.

Order of volatility

The sequence for collecting evidence from most to least perishable: CPU registers and cache, memory, network state, disk, then backups and archival media.

Eradication

Removing the root cause of an incident, including malware artifacts, malicious accounts, persistence mechanisms, and the initial access vector, rather than only its visible symptoms.

Recovery criteria

Conditions met before returning systems to production: cleaned or rebuilt from trusted media, patched to baseline, credentials rotated, monitoring heightened, and validation testing passed.

Re-imaging versus cleaning

Re-imaging restores a system from a known-good image and is preferred when compromise depth is unknown or the asset is high value; cleaning risks leaving undetected persistence behind.

Post-incident review timing

Holding the lessons-learned review within roughly two weeks of incident closure, while details are fresh and before corrective actions lose organizational momentum.

Root-cause analysis techniques

Structured methods such as 5 Whys, Ishikawa fishbone diagrams, and fault-tree analysis used to separate the proximate trigger from the underlying missing control.

Response metrics

Quantitative measures captured per incident, such as time to detect, contain, and eradicate; dwell time; affected assets and records; and total response and downtime cost.

Corrective action tracking

Logging each lessons-learned action in the risk register or ticketing system with a named owner and due date, then verifying closure, since unclosed actions are the commonest failure.

Communication plan cadence

Pre-agreed timing for incident updates, such as initial notification within one hour and status updates every four hours, with named audiences and approval authority per message.

Single voice principle

Designating one approved spokesperson and one point of contact so external statements stay consistent, avoiding contradictions that create legal and reputational exposure.

Chain of custody

A documented record of every transfer and handling of evidence, showing who had it, when, where, and why, so it remains admissible and defensible in proceedings.

GDPR 72-hour notification

Where a personal-data breach is likely to result in risk to rights and freedoms, the controller must notify the supervisory authority within 72 hours of becoming aware.