Incident Response and Remediation
Domain 3 covers what happens once you believe an incident is real: scoping, containing without destroying evidence, eradicating persistence, restoring safely and closing the loop. CBRCOR favours the NIST SP 800-61 structure over improvisation, and it tests order of operations as much as the actions themselves.
Phases (NIST SP 800-61)
- Preparation - playbooks, contact trees, tooling, jump bag, tabletop exercises.
- Detection and analysis - validate, scope, assign severity.
- Containment, eradication and recovery.
- Post-incident activity - lessons learned, root cause, detection improvements.
Containment choices
- Network isolation of the host - EDR containment keeps the agent reachable for investigation; a VLAN move or port shutdown does not.
- Egress blocking - hash, domain, IP or URL category at proxy, DNS and firewall.
- Identity actions - disable the account, revoke sessions and refresh tokens, force a password reset.
- Segmentation and sinkholing for malware that is spreading. Choose by blast radius: a domain controller compromise justifies immediate isolation; one user's adware does not.
Evidence handling
Follow the RFC 3227 order of volatility: CPU registers and cache, memory, network state and ARP, running processes, disk, remote logs, archival media. Capture memory before powering down, image disks through a write blocker, hash with SHA-256 at acquisition and re-verify, and log every transfer on a chain-of-custody form recording who, what, when, where and why.
Worked example
Ransomware notes appear on a file server. Step 1: isolate the NIC through the EDR console but leave power on so memory survives. Step 2: capture memory and the EDR process tree, which usually identifies the patient-zero host and parent process. Step 3: scope - enumerate SMB sessions and check the backup server's logs. Step 4: eradicate by reimaging, removing persistence (services, scheduled tasks, WMI subscriptions, Run keys) and rotating every credential that touched the host, including service accounts. Step 5: restore from a backup verified as pre-compromise and monitor for re-infection. Step 6: post-incident review with a timeline and detection-gap actions.
Traps
- Powering the host off before memory capture.
- Imaging without a write blocker or without hashing.
- Waiting for complete scoping while encryption spreads - contain first and scope in parallel.
- Assuming backups are clean because they exist.
- Confusing eradication (persistence removed) with recovery (service restored).
- Forgetting notification clocks, such as GDPR's 72 hours.