Incident Response, Forensics, Business Continuity, Risk and Threat Assessment
Incident Response
The lifecycle
Use the six-phase model: Preparation (plan, playbooks, tools, training, tabletop exercises, contact lists, jump bag); Identification/Detection (triage, validation, scoping, severity classification); Containment (short-term isolation to stop spread, long-term segmentation until eradication); Eradication (remove malware, close the root cause, patch, reset credentials); Recovery (restore from known-good backups, verify, monitor closely); Lessons Learned (post-incident review, control gaps, playbook updates).
Incident categories worth naming: malware/ransomware, phishing, unauthorized access, insider misuse, DoS, data leakage, web defacement, and policy violation. Roles include incident commander, analyst, communications, legal, and management.
Evidence and communication
Preserve evidence before changing state: capture memory and logs, note the order of volatility, and maintain chain of custody. Containment decisions trade business impact against evidence loss.
Traps
Candidates routinely power off a compromised host - that destroys volatile memory. The correct first containment is usually network isolation (unplug the cable or disable the switch port, or move to a quarantine VLAN) while keeping the system running for forensics. Another trap is responding with eradication before containment (fixing a host that is immediately reinfected). Also, identification is not the same as notification; escalation and communication are separate steps.
Rule of thumb
When sequencing questions appear, remember: contain before you eradicate, preserve before you remediate, and confirm the scope (all affected hosts) before you declare recovery. Severity should be set by business impact and data sensitivity, not by the number of alerts.
Forensics
Process and integrity
Digital forensics follows identification, preservation, acquisition, examination, analysis, and reporting. Preserve first, then analyze. The classic rule is order of volatility: CPU registers and cache, RAM and swap, network state and ARP/DNS caches, running processes, temporary files, disk, remote logs, archival media. Live acquisition is used when volatility demands it; otherwise perform a dead analysis on a bit-stream image created with a write blocker, verified by comparing hashes (SHA-256 preferred; MD5 still appears) of the source and the image. Hashes prove integrity, not authorship - they are not signatures.
Chain of custody documents who handled the evidence, when, where, and why; any gap can make evidence inadmissible.
Artifacts
Windows: NTFS MFT and $LogFile, USN journal, registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT), Prefetch, Amcache/Shimcache, event logs, browser history, jump lists, recycle bin, Volume Shadow Copies. Linux: /var/log entries, .bash_history, /etc/passwd and shadow, cron, systemd journal, deleted inodes. Network: firewall, proxy, DHCP, and NetFlow records, packet captures. Mobile: backups, app databases, location data.
Techniques include timeline analysis (super-timeline from multiple sources), file carving from unallocated space, keyword and hash-set filtering, and anti-forensics detection (timestomping, log wiping, steganography).
Traps
Never boot a suspect disk on the original machine - booting modifies timestamps and logs. A copy made with a normal OS mount is not forensically sound. Also distinguish chain of custody (documentation) from hash verification (integrity), and remember that deleted files may remain in unallocated space.
Rule of thumb
Before touching anything, answer: what is the most volatile thing that will disappear first, and can I prove later that nothing changed?
Business Continuity, Risk and Threat Assessment
Continuity metrics
Business continuity keeps the organization operating; disaster recovery restores technology. The Business Impact Analysis identifies critical processes and derives the metrics examiners love: MTD (maximum tolerable downtime), RTO (target time to restore a process or system), RPO (acceptable data loss measured backward from the failure), MTBF (reliability), and MTTR (repair time). Sites are hot (fully operational, instant failover), warm (equipment and partial data, hours to days), and cold (space and power only, longest recovery). Backup types: full (everything, resets the archive bit), incremental (changes since the last backup of any type, fastest backup and slowest restore), differential (changes since the last full, slower backup and fast restore requiring only the last full plus one differential). Follow 3-2-1: three copies, two media types, one offsite; add immutable/offline copies for ransomware resistance.
Risk assessment
Risk is the combination of threat likelihood and impact against a vulnerability. Quantitative analysis: Asset Value × Exposure Factor = SLE; SLE × Annualized Rate of Occurrence = ALE. Qualitative analysis uses scales such as high/medium/low. Treatment options are mitigate, transfer (insurance), avoid, and accept. Threat modeling frameworks include STRIDE and attack trees; standards include NIST CSF, ISO 27001, and ISO 22301 for continuity.
Traps
RTO and RPO are confused constantly: RTO is time to restore, RPO is data loss tolerated. Incremental restores need the last full plus every incremental in sequence; differential needs the last full plus one differential. Risk acceptance requires management sign-off - an analyst cannot accept risk alone.
Rule of thumb
BIA first, metrics second, strategy third, tests and exercises fourth. Any answer that skips the BIA and jumps to technology has the order wrong.