Incident Handling and Response Process
The six phases
Memorise the sequence and, more importantly, what belongs in each: Preparation (policy, team, tooling, communication plans, jump kits, training, baseline data), Identification (detection, validation, scoping, severity assignment, ticketing), Containment (stop the spread - short-term and long-term), Eradication (remove the root cause, delete malware, close the vulnerability, reset credentials), Recovery (restore systems to production, verify integrity, monitor closely), Lessons Learned (post-incident review, metrics, process and control improvements).
Where candidates lose marks
- Containment is not eradication. Isolating a host stops spread; it does not remove the implant. Questions often ask for the next step after isolation.
- Containment strategy is a judgement call, not a reflex. Two documented options: shut the system down / disconnect (protects others, destroys volatile evidence, may alert the attacker) versus monitor and contain (gather intelligence at the risk of further damage). Justify by data criticality and attacker sophistication.
- Identification must include scoping. One infected workstation is rarely the whole story; ask what it authenticated to.
- Lessons learned is not optional paperwork. It should produce measurable outputs - new detections, patched gaps, revised playbooks.
Documentation and evidence
Every action must be timestamped, attributed and justified. Maintain chain of custody for any item that may become evidence, hash images at acquisition, and keep the incident log contemporaneous. Notification duties (regulators, customers, law enforcement) are decided early in containment, not at the end.
Worked example - ransomware on a file server: Preparation gave you an offline backup and a playbook. Identification confirms encryption notes and a known extension. Containment: disable the NIC/isolate via EDR, disable the compromised service account, block the C2 domain at the perimeter. Eradication: remove the dropper and the scheduled task, patch the exposed VPN appliance. Recovery: restore from the verified offline backup, validate integrity, monitor for re-infection for 30 days. Lessons learned: add detections for the scheduled-task creation, fund MFA on VPN, retest backups.