Incident Management
The response lifecycle
Incident management covers the preparation, detection, response and learning cycle. Know the phases: prepare (plan, roles, contact lists, tooling, training, exercises); detect and analyse (monitoring, triage, classification and severity); contain; eradicate; recover; and post-incident review with lessons learned fed back into the program. Understand severity classification and escalation criteria agreed in advance, defined roles including an incident commander, legal counsel and communications, evidence preservation and chain of custody, forensic soundness, internal and external communications, and regulatory or contractual notification obligations. Know how the incident response plan interlocks with business continuity and disaster recovery.
Traps
Ambiguity about "first action" is the classic trap. The usual correct sequence is to validate and classify the incident, activate the plan, protect people, then contain while preserving evidence. Rebooting or reimaging a compromised host before capture destroys forensics. Premature notification to customers, media or regulators is almost always wrong - communication follows the plan and legal advice. Another trap is confusing the CISO's accountability for the capability with personally directing hands-on technical work. Do not let urgency erase documentation; logs written during the event support later legal and regulatory needs.
Worked example
Ransomware is found on a file server. The strongest first move is to isolate the host to stop propagation while preserving evidence, confirm severity and escalate per the plan - not to immediately restore from backup, and certainly not to pay.
Rule of thumb: contain first, communicate per the plan, preserve evidence, and always hold a post-incident review.