Incident Response and Investigation
Incident Response and Investigation covers the NIST SP 800-61 lifecycle, evidence handling, and scoping an intrusion. The exam expects you to choose containment actions that preserve evidence and business continuity, then investigate with defensible artifacts.
Lifecycle
- Preparation: playbooks, communication plans, tooling, legal/privacy contacts, jump kit.
- Detection and analysis: validate the alert, declare an incident, assign severity, scope affected assets and data.
- Containment, eradication, recovery: short-term containment, long-term containment, remove persistence, restore from trusted backups.
- Post-incident activity: lessons learned, detection improvements, and reporting.
Evidence handling
Follow order of volatility (RFC 3227): CPU/registers/cache, memory, network state, running processes, disk, remote logs, backups. Use chain of custody, SHA-256 hashes, write blockers, forensic images, and UTC timestamps. Legal hold and breach notification obligations vary by jurisdiction and sector.
Worked example
A ransomware note appears on a file server. Reasoning: isolate the host through Secure Endpoint rather than powering it off, preserving memory. Capture volatile data, identify patient zero using Secure Network Analytics flows and Umbrella DNS, check backup integrity, and scope lateral movement through ISE and AD logs. Eradicate persistence, restore from a clean backup, and hold a post-incident review. Powering down first would destroy memory evidence.
Traps that cost marks
- Powering off or shutting down before memory capture.
- Deleting malware or rebuilding before evidence is preserved.
- Containing too broadly and disrupting business, or too narrowly and allowing spread.
- Missing notification timelines and legal obligations.
- Resetting credentials before collecting evidence of credential theft.
Key points
- NIST SP 800-61: preparation, detection/analysis, containment/eradication/recovery, post-incident.
- Order of volatility guides what to collect first.
- Chain of custody and hashing make evidence defensible.
- Isolate to contain; avoid powering off before memory capture.
- Scoping requires identity, network, endpoint, and DNS evidence together.