Security Operations and Incident Response
Security Operations and Incident Response tests how a SOC detects, escalates, and contains incidents. CJCA focuses on process order, evidence handling, and the difference between containment and eradication.
Core rules
- The NIST incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.
- Triage confirms whether an alert is a true positive, scopes affected assets, and assigns severity. Playbooks make response repeatable.
- Containment stops spread (isolate host, disable account, block IP). Eradication removes the cause (delete malware, patch vulnerability). Recovery restores normal operations and validates integrity.
- Chain of custody documents who handled evidence, when, and where. Preserve volatile data such as memory before powering off when practical.
- Communication and escalation run in parallel; legal, privacy, and management may need notification.
Worked example
A file server shows ransomware notes and encrypted shares. The first priority is containment: isolate the server from the network, disable compromised accounts, and block known C2 indicators, while preserving memory and logs. Do not immediately reimage the host, because that destroys evidence and may hide persistence. After containment, identify the entry point, eradicate the malware and vulnerable service, restore from a verified backup, and monitor for re-infection. Post-incident review documents timeline, root cause, and control gaps.
Traps
Do not eradicate before containment; the attacker may still be active. Do not power off a host before collecting volatile evidence unless safety requires it. Do not delete logs to clean up. A false positive still needs documentation and tuning, not silence.