Incident Response Fundamentals and Frameworks
Core distinctions
An event is any observable occurrence in a system or network; an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability, or violates policy. Most classification questions hinge on this line: an alert is not automatically an incident, and a vulnerability is not an incident until it is exploited or exposure is confirmed.
The frameworks a candidate must be able to tell apart
- NIST SP 800-61 describes four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
- SANS / PICERL is an operational loop: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned, and it splits containment into short-term and long-term.
- ISO/IEC 27035 organizes IR around plan-and-prepare, detection and reporting, assessment and decision, responses, and lessons learned. ISO/IEC 27001 is a management-system standard, not an IR lifecycle.
Also know severity and priority schemes that combine impact with scope, who holds authority to declare an incident, escalation paths, and the roles that must be filled: incident commander, handler/analyst, communications lead, legal, and subject-matter experts.
Traps that appear in questions
Placing eradication before containment. Confusing ISO 27035 with ISO 27001. Ending analysis the moment exfiltration is ruled out, when persistence and scope are still unknown. Treating lessons learned as optional paperwork rather than a phase output.
Rule of thumb
If you cannot state the impact and the affected scope in one sentence, you are still in detection and analysis - not containment.