Defensive Cyber Operations and Incident Response
Frameworks you must be able to name
CJCSM 6510.01B governs DoD cyber incident handling with six phases: preparation, identification, containment, eradication, recovery, and follow-up. NIST SP 800-61 uses four: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Know both and know which question is asking which.
Core rules
- Containment is a trade-off, not a reflex. Isolation stops spread but destroys attacker situational awareness and can tip off the adversary; segmentation, sinkholing, and ACL blocks preserve visibility.
- Order of volatility (RFC 3227): collect CPU registers and cache, then memory, then network state, then disk, then remote logs and backups. Capture before you remediate.
- Indicators versus TTPs. Hashes and IPs are cheap and short-lived; behavioral detections mapped to MITRE ATT&CK survive infrastructure rotation.
- Dwell time measures detection failure, not response speed. Track it as a defensive metric.
- Layer controls: EDR on the endpoint, network detection at the boundary, identity telemetry in the directory, and centralized logging that an adversary cannot reach.
Worked example
A host is confirmed beaconing and encrypting files on a shared drive. The commander asks whether to power it off immediately. Reasoning: pulling the plug destroys volatile memory that holds the beacon configuration and possibly the encryption keys. Correct sequence is network-isolate while keeping the host powered, capture memory, then image the disk, then eradicate and rebuild from a known-good image. Recovery without verified clean backups invites re-infection.
Traps that cost marks
Believing antivirus alerts equal incident closure; eradicating before capturing evidence; treating containment as always equal to shutdown; forgetting that the post-incident phase produces the detection content that prevents recurrence.