ECIH key terms

An actual or attempted violation of security policy or acceptable use that harms, or could harm, the confidentiality, integrity, or availability of systems and data, and that needs coordinated handling rather than routine fixing.

A written document defining who does what during a security incident, including roles, escalation paths, communication channels, decision criteria, and the procedures responders follow under pressure.

Computer Security Incident Response Team: the named group of analysts, managers, and liaisons authorized to detect, investigate, and coordinate the response to security incidents across the organization.

The repeating set of phases-preparation; detection and analysis; containment, eradication, and recovery; post-incident activity-that organizes how an organization handles incidents from first alert to closure.

The ongoing phase of building response capability before any specific incident: policies, team staffing, tooling, contact lists, access to logs, training, and exercises that test the plan.

Limiting the spread and impact of an incident by isolating hosts, disabling accounts, blocking traffic, or segmenting networks, while keeping enough evidence and access for the investigation to continue.

Removing the cause of an incident-malicious files, attacker accounts, backdoors, and exploited vulnerabilities-so the threat cannot resume once normal operations are restored.

A structured review after an incident that compares what happened with what the plan expected, identifies gaps in tools, people, or process, and assigns tracked improvements with owners and deadlines.

A documented, unbroken record of who collected, handled, transferred, and stored each item of evidence, and when, used to show the evidence has not been altered.

The pre-agreed process for handing an incident to more senior, specialized, or non-technical responders-management, legal, public relations-when its severity, scope, or sensitivity exceeds the current handler's authority.

The individual who first reaches a suspected compromised system, often help-desk or on-site IT staff, whose early choices about shutting down, unplugging, or rebooting decide what evidence survives.

A priority ranking of evidence by how fast it disappears-registers and memory, then network state, then disk, then backups and logs-used to decide what to capture first.

A hardware or software bridge between a suspect drive and the analysis machine that permits read operations only, so the original media is never altered during acquisition.

A bit-for-bit duplicate of a disk, partition, or memory region, hashed at acquisition so any later change can be detected, which analysts examine in place of the original.

A fast first-pass assessment of an alert that estimates severity, affected assets, and likely scope so limited responder time goes to the most damaging cases first.

Malicious software that encrypts or steals data and demands payment for a decryption key or to prevent release, typically after quietly spreading through the network before the payload triggers.

Malware that hides its files, processes, drivers, and network connections by subverting operating system internals, so ordinary tools on the live host report a clean machine.

A piece of forensic evidence-file hash, domain, IP address, registry key, or mutex-suggesting a host or network is compromised and usable to hunt for other affected systems.

An isolated, instrumented environment where a suspicious file or URL is detonated and observed, recording its network traffic, file changes, and behavior without endangering production systems.

A deceptive message posing as a trusted person or brand that pushes the recipient to reveal credentials, approve a payment, click a link, or open a malicious attachment.

Fraud in which an attacker takes over or convincingly impersonates a business mailbox to authorize fake invoices, change payment details, or extract sensitive information from colleagues and partners.

Reading the routing and authentication fields of a message-Received chains, Return-Path, Message-ID, and authentication results-to establish its real origin and whether it was spoofed.

Three DNS-based controls that let a domain owner declare which servers may send its mail (SPF), cryptographically sign messages (DKIM), and tell receivers how to treat failures (DMARC).

Dividing a network into zones separated by controlled choke points, so a compromised host cannot reach critical systems freely and responders can cut off a segment quickly.

Summaries of network conversations-source, destination, ports, byte and packet counts, timestamps-exported by routers and switches, letting analysts spot unusual patterns without storing full packets.

An attack flooding a service or link with traffic from many sources so legitimate users cannot get through; it may also serve as cover for a quieter intrusion elsewhere.

The steps an attacker takes inside a network after the first host falls-reusing stolen credentials, remote services, or admin tools-to reach more systems and higher-value data.

A script uploaded to a compromised web server that gives the attacker a remote command or file interface through ordinary HTTP requests, blending in with normal web traffic.

A reverse proxy in front of a web application that inspects HTTP requests, blocks patterns matching known attacks, and logs blocked attempts for investigation and temporary protection.

An attack that slips database commands into user-supplied input so the application executes them, letting the attacker read, alter, or delete records; responders trace it to unparameterized queries and exposed error pages.

The split of security duties in cloud services: the provider secures the physical and virtual infrastructure it operates, while the customer secures the data, identities, and configuration it controls.

A wrong setting in a cloud resource-public storage, permissive identity policy, open management port-that exposes data or access without any software vulnerability being exploited.

Provider-generated records of control-plane API calls and resource changes in a cloud account, forming the main evidence trail when investigating who did what and when.

Harm caused by someone with legitimate access-employee, contractor, or partner-who misuses it deliberately or through negligence to expose, alter, or destroy organizational data.

Unauthorized movement of data out of an environment by email, cloud sync, removable media, or covert channels, often the final step before an insider or intruder is discovered.

Baselining normal activity for users and entities-logon times, data volumes, access patterns-then flagging deviations that hint at a compromised account or a malicious insider.

Agent software on hosts that continuously records process, file, and network activity, applies behavioral detection, and lets analysts query, isolate, or collect evidence from machines remotely.

A response action that severs a host's ordinary network connectivity while keeping the management channel open, halting spread and command-and-control while analysts investigate live.

A configuration planted so malicious code restarts after reboots or cleanup-run keys, services, scheduled tasks, startup folders-that responders must find or the infection returns.