Incident Handling: Lifecycle, Evidence, and Order of Operations
The lifecycle
Use the classic four-phase model: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Preparation means playbooks, contact lists, tooling, logging and SIEM coverage, plus tabletop exercises. Detection and analysis turns alerts, indicators of compromise, and user reports into a validated incident - resist the urge to declare an incident on a single unverified alert.
Containment stops the spread: isolate the host, disable the account, block the IP, segment the network. Short-term containment buys time; long-term containment keeps the business running while the root cause is addressed. Eradication removes the cause (malware, the vulnerable service, the compromised credential). Recovery restores service and validates it - watch for re-infection before declaring victory.
Post-incident activity is the lessons-learned review: what detection failed, which playbook step lagged, what control to add. Track mean time to detect and to respond.
Evidence discipline
Maintain chain of custody, hash disk images, and follow the order of volatility: processor and cache, memory, temporary files, disk, remote logs, archival media. If volatile evidence matters, capture it before powering anything off. Reimaging a host immediately destroys evidence - a favorite wrong answer.
Roles and obligations
An incident commander coordinates; communications, legal/HR, and forensic specialists support. Regulatory and contractual breach notification may run on a clock, so involve legal early.
Rule of thumb
Prepare → Detect → Contain → Eradicate → Recover → Learn. Contain first, then investigate deeper - except when containment would destroy the only volatile evidence, in which case capture that evidence first.