Incident Response and Recovery
Prepare, detect, contain, recover, learn
Use the NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Questions love asking what comes first - stopping a spreading infection generally outranks capturing every last artifact, but preserve volatile data whenever it is safe to do so.
Triage weighs impact, scope, criticality and data sensitivity. Know the common categories (malware, DoS, unauthorized access, insider, web compromise) and the roles in the IR team: incident handler, analyst, communications lead, management escalation.
Evidence handling: collect in order of volatility - CPU registers and cache, memory, network connections, temp files, disk, logs, backups, archival media. Image drives with a write blocker, hash before and after, never work on the original, and maintain chain of custody (who handled it, when, and why).
Recovery and continuity: RTO/RPO/MTD; hot site (near-instant failover, most expensive), warm, cold, and reciprocal agreements. Backup types matter: full, incremental (everything changed since the last backup of any kind; slower restore), differential (everything changed since the last full; faster restore than an incremental chain). Test restores - an untested backup is a hope.
Trap: eradicating before containing, or wiping and rebuilding a host that still holds evidence. Also, "restore from verified backup" answers recovery, not eradication.
Worked example: ransomware on a file server. Contain (isolate the host, disable the account, block command-and-control), analyze (identify strain, scope, patient zero), eradicate (remove persistence, rebuild), recover (restore from verified offline backup), then document lessons learned.
Rule of thumb: containment first; before touching a live system, decide whether you need the evidence more than the uptime.