Incident Response: NIST Lifecycle, Containment, and Evidence
The NIST SP 800-61 lifecycle
Four phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, (4) Post-Incident Activity. Many questions simply ask which phase an action belongs to, so memorize the verbs: writing lessons learned and updating playbooks is post-incident; isolating a host is containment; reimaging is eradication/recovery.
Preparation covers the IR plan, playbooks, tooling and jump kit, contact lists, out-of-band communications, roles (incident commander, communications lead, legal, HR, technical leads), and tabletop exercises.
Detection and analysis covers triage, validation, scoping, and declaration; timeline documentation starts here and never stops.
Containment is short-term (isolate the host, block the IP or domain, disable the account) or long-term (rebuild, segment, patch). The trade-off - containment can destroy evidence or tip off the attacker - is a favorite trap answer.
Eradication removes the root cause; recovery restores operations with heightened monitoring.
Evidence: follow order of volatility - registers/cache → memory → network state and temp files → disk → remote logs → archival media. Capture the most volatile first. Maintain chain of custody (who, what, when, where, why), hash images with SHA-256, use write blockers, and image before you analyze.
Worked example: ransomware is spreading on a file server. Contain first (segment or disconnect it, disable compromised accounts), preserve memory and disk images, eradicate the malware and patch the entry vector, restore from a validated clean backup, then hold the post-incident review. Reimaging first is wrong because it destroys evidence.
Rule of thumb: for "first step" questions, choose the least destructive action that stops the spread - isolate or disable, not wipe.