IR Level I flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Incident

An event that actually or potentially jeopardizes the confidentiality, integrity, or availability of information or a system, or violates security policy.

Event

Any observable occurrence in a system or network, such as a user login or a firewall blocking a packet; most observed events are not incidents, which require actual or potential harm.

NIST SP 800-61 lifecycle

Four-phase incident response lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity, in which lessons learned feed back into preparation.

Incident commander

Role that owns incident decisions, approves containment actions, and controls escalation; the commander coordinates the team and briefs executives rather than performing hands-on technical investigation.

Severity scoring

Incident severity combines business impact, number and criticality of affected assets, data sensitivity, and whether activity is ongoing; the score sets escalation level and notification obligations.

IR plan minimum contents

Documented roles, escalation paths, contact lists, communication channels, severity definitions, and playbooks per incident type, approved by management and reviewed at least annually.

Tabletop exercise

Discussion-based session where responders walk through a simulated scenario to test plans, decision-making, and communication without touching live systems; findings become tracked corrective actions.

Jump kit

Pre-packed forensic toolkit holding a write blocker, imaging and hashing utilities, sterile media, chain-of-custody forms, and a laptop with validated analysis tools, ready before an incident occurs.

Out-of-band communication

A coordination channel independent of corporate email and network, such as a pre-arranged conference bridge or messaging service, usable when primary systems are compromised or unavailable.

Log retention period

Configured duration logs are kept before deletion; it must exceed expected attacker dwell time and satisfy legal or regulatory minimums so investigations retain usable evidence.

Order of volatility

RFC 3227 collection order: registers and cache first, then memory, network state, running processes, disk, remote logs, and archival media, so the most perishable evidence is captured first.

Pyramid of Pain

Model ranking indicators by the friction they cause an adversary when changed, from cheap-to-change file hashes and IP addresses up to costly tactics, techniques, and procedures.

Chain of custody

Chronological record of who collected, handled, transferred, and stored evidence, with timestamps, purpose, and hashes, demonstrating integrity if evidence is used in legal proceedings.

Indicator of compromise

Observable artifact such as a file hash, IP address, domain, or registry key suggesting intrusion; atomic indicators are low fidelity and expire quickly compared with behavioral TTP indicators.

Alert triage outcomes

Each alert resolves to true positive (real malicious activity), benign true positive (rule correctly matched legitimate activity), or false positive (rule matched incorrectly), driving escalation decisions.

Network containment

Isolating a host or segment with firewall rules, VLAN changes, or endpoint-agent isolation while leaving it powered on, so memory evidence and remote investigation remain available.

Eradication

Phase that removes the attacker foothold: deleting malware, rebuilding compromised hosts from trusted images, patching the exploited vulnerability, and invalidating stolen credentials and sessions.

Rebuild versus clean

Decision rule: rebuild from known-good media when persistence, rootkit infection, or configuration integrity is uncertain; clean in place only when compromise scope is fully established.

Recovery validation

Confirming restored systems are clean and functional, data integrity matches expectations, the original entry vector is closed, and monitoring is heightened before assets return to production.

krbtgt reset

In Active Directory Golden Ticket attacks, the krbtgt account password must be reset twice with domain replication between resets, otherwise forged Kerberos tickets remain valid.

Lessons learned meeting

Post-incident review held within roughly two weeks of closure with responders and stakeholders to document the timeline, what worked, what failed, and corrective actions with owners.

Root cause analysis

Method such as the Five Whys that moves past the immediate trigger to the underlying process or control failure that allowed the incident to occur and persist.

Corrective action tracking

Register listing each post-incident improvement with owner, due date, and status; items remain open until verified effective, often retested in the next exercise or audit.

Post-incident report

Final document with executive summary, scope, timeline, root cause, business impact, evidence references, and prioritized recommendations, distributed on a need-to-know basis.

Tactical threat intelligence

Intelligence describing adversary tactics, techniques, and procedures, used to build detections and hunt hypotheses; it stays relevant far longer than atomic indicators such as hashes.

TLP markings

Traffic Light Protocol labels - RED, AMBER, GREEN, CLEAR - defining how far information may be shared; RED restricts distribution to the meeting or named recipients.

STIX and TAXII

Complementary standards for threat intelligence exchange: STIX defines the structured data model for objects and relationships, while TAXII defines the transport protocol used to share them.

Hypothesis-driven hunting

Proactive search that starts from an ATT&CK technique or behavioral hypothesis rather than an alert; successful hunts are converted into automated analytics and detections.

GDPR 72-hour rule

Controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.

SEC four-day disclosure

US public companies file Form 8-K Item 1.05 describing a material cybersecurity incident within four business days of determining that the incident is material.

Legal hold

Directive suspending deletion or alteration of records and evidence once litigation, regulatory investigation, or audit is reasonably anticipated, preserving potentially relevant data under counsel's direction.

NIS2 notification timeline

EU directive requiring an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month for significant incidents.