Security Operations, Monitoring, and Incident Response
Security operations questions test detection, triage, containment, and evidence handling. Healthcare adds clinical uptime pressure and mandatory breach-notification decisions.
Core capabilities
A SIEM aggregates logs from identity, EDR, firewalls, EHR audit trails, and cloud. Detection engineering writes use cases for impossible travel, mass record access, privilege changes, and malware. SOAR automates enrichment and containment. UEBA baselines clinician behaviour. Triage assigns severity by data sensitivity and blast radius. The incident response lifecycle follows NIST SP 800-61: prepare; detect and analyse; contain, eradicate, recover; post-incident activity. Preserve evidence using order of volatility and chain of custody.
Breach coordination
Legal, privacy, and communications join the incident team early. Determine whether ePHI was accessed or exfiltrated. If a breach is confirmed, start the HIPAA 60-day clock and assess the GDPR 72-hour notification duty. Do not delay containment for notification decisions, and do not notify prematurely without facts.
Worked example
SIEM alerts on 500 failed logins followed by a success from an unusual country for a clinician account. Triage confirms no MFA prompt. The team disables the account, isolates the endpoint, captures memory, and reviews EHR audit logs for record access. The privacy officer determines that 12 records were viewed; legal assesses the breach threshold. The endpoint is reimaged after evidence capture, and the user is re-enrolled with phishing-resistant MFA. Reasoning: containment first, evidence preserved, scope determined from audit logs.
Traps
Wiping or reimaging before capturing volatile evidence. Alert fatigue with no tuning. No playbooks or call trees. Letting clinicians block isolation of a compromised workstation. Notifying regulators before scope is known. Confusing an event with a reportable incident.