Incident Response
Incident Response
The incident response domain rewards knowing the process order and what evidence you may destroy at each step. The canonical lifecycle: Preparation → Detection/Identification → Containment → Eradication → Recovery → Post-incident activity (lessons learned). Containment precedes eradication, and containment is often temporary - isolate the host, sinkhole the domain, disable the account, block the hash - before full eradication such as reimaging, patching, and removing persistence.
Evidence handling is heavily tested. Preserve, don't "clean." Never power off a suspected compromised host to stop malware: pulling the network cable or disabling the switch port preserves volatile memory and logs while limiting spread, and that is almost always the intended answer. Follow the order of volatility: CPU registers and cache → RAM → swap/pagefile → network state (ARP, connections) → running processes and temp files → disk → remote logs → backups and archives. Capture the most volatile first. Use write blockers, hash images before and after acquisition, and record every handoff on a chain-of-custody form with who, what, when, and why.
Triage and severity classification drive escalation. Know which incidents demand legal, HR, or law-enforcement involvement: insider threat, exposure of PII or PHI, and any suspected criminal activity. Communication plans define who speaks to whom, on what cadence, and who is authorized to speak to media and regulators - engineers do not notify the press.
Traps: confusing a containment action with an eradication action, assuming "delete the file" is remediation, skipping validation during recovery, and treating lessons learned as optional. Tabletop exercises are a Preparation activity, not a post-incident one.
Worked example. An analyst finds ransomware actively encrypting a file server. The best immediate action is to isolate the host from the network at the switch - not shut it down, and not start deleting encrypted files - because isolation limits lateral spread while preserving memory and logs for root-cause analysis.