Security Operations and Incident Response
The response lifecycle
Prepare → detect and analyze → contain → eradicate → recover → lessons learned. Containment is short-term stabilization (isolate host, block port, disable account) and comes before eradication (remove malware, patch, rebuild). Never reconnect a system before verification. Lessons learned closes the loop and feeds back into preparation and control selection.
Evidence handling
Preserve first, analyze second. Follow the order of volatility: CPU registers/cache → RAM → network state (connections, ARP) → running processes → disk → backups and archival media. Document every transfer; maintain chain of custody capturing who, what, when, where and why; hash images to prove integrity; work on copies, never originals.
Operations
A SIEM aggregates and correlates logs, and needs tuning or alerts become noise. Vulnerability management is a cycle: discover, prioritize (exploitability and asset criticality, not raw CVSS alone), remediate, verify. Change management prevents outages and preserves an audit trail. BCP/DR terms: MTD is maximum tolerable downtime, RTO is the target restore time, RPO is acceptable data loss measured in time. Backups: full; incremental (fast to make, slow to restore - needs the whole chain); differential (slower to make, faster to restore - needs the last full).
Traps
Confusing containment with eradication; swapping RTO and RPO; pulling the plug before capturing memory; treating lessons learned as optional.
Worked example
Ransomware hits a file server: isolate the NIC (contain), capture a memory image and logs, identify patient zero, rebuild from a clean backup taken before encryption, then check RPO - if the newest clean backup is 26 hours old against a 4-hour RPO, that gap becomes a finding in the lessons-learned report.