Security Operations and Incident Response
Security Operations and Incident Response tests the run-time side: what you monitor, how you classify an event, and the order in which you act. Scenario questions often describe a live intrusion and ask what to do first.
Operations basics
A SOC correlates logs in a SIEM, tunes detections to limit false positives, and escalates by severity. Log sources must be time-synchronised (NTP) and forwarded off-host so an attacker cannot erase them locally. Under China's Cybersecurity Law, network logs must be retained for at least six months. Operational hygiene also includes vulnerability remediation SLAs, change control, and asset inventory - you cannot monitor what you have not catalogued.
Response phases
Remember the sequence: prepare → detect → contain → eradicate → recover → follow-up. Containment isolates affected hosts and blocks command-and-control; eradication removes the root cause (malware, vulnerable service, rogue account); recovery restores verified-clean service; follow-up captures lessons learned. Response plans require named owners, contact trees, defined escalation paths and rehearsed exercises.
Evidence handling
Follow order of volatility: capture memory and network state before disk, and disk before remote logs. Use a write blocker, hash every image, and record every transfer in a chain-of-custody form; a hash mismatch destroys evidentiary value.
Worked example
Ransomware is encrypting files on a file server. The analyst's instinct is to power off the machine - this is wrong. Powering off destroys volatile memory that may hold encryption keys, running processes and network connections. Correct sequence: isolate the host from the network at the switch or firewall (containment), preserve a memory image and disk image with hashes, identify the entry vector and any lateral spread, then eradicate and restore from a validated offline backup. Reporting to the internal owner and, where required, to CNCERT/CC and public security follows the incident plan.
Traps
- Eradicating before containing, letting the attacker keep spreading.
- Pulling the power plug and losing volatile evidence.
- Confusing RTO (time to restore service) with RPO (tolerable data loss).
- Skipping the lessons-learned stage, so the same vector recurs.
- Forgetting mandatory reporting timelines and log-retention duties.