Introduction to Incident Handling and Response
Vocabulary that exam questions exploit
An event is any observable occurrence in a system or network - a logon, a firewall block, a service starting. An adverse event is an event with a negative consequence (a crash, a failed disk). An incident is a violation - or an imminent threat of violation - of security policies, acceptable-use policies, or standard security practices. Two failed logons from one user is an event. Four hundred failed logons across forty accounts from one foreign IP, followed by one success, is an incident candidate. Keep that line crisp: the exam routinely offers a benign log line and asks you to classify it.
Handling versus responding
Incident handling is the broader management discipline: building the capability, defining policy, training the team, running the six-phase process, and coordinating the response. Incident response is the tactical activity performed during a live incident. Related but distinct disciplines are digital forensics (reconstructing what happened for legal or root-cause purposes) and business continuity/disaster recovery (keeping or restoring the business function). A common trap is choosing “forensics” when the question asks for the organisational capability that plans, trains, and coordinates.
Teams and frameworks
Know the actors: SOC (continuous monitoring and triage), CSIRT/CERT (the response team), CIRT, and JRT (joint response across organisations). Know the phase models: NIST SP 800-61 (Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity) and the EC-Council six-phase lifecycle. Be able to map them; questions sometimes name a NIST phase and expect the equivalent EC-Council phase. Also know incident classification by severity and functional impact, and attacker-methodology models such as Cyber Kill Chain and MITRE ATT&CK used to predict the next step.
Rule of thumb: if you cannot state who, what, when, and business impact in one sentence, you have an alert - not yet an incident.