Incident response and security operations
Incident response and security operations tests the lifecycle from preparation to lessons learned. Questions ask what to do first, what evidence to preserve, and which metric or tool supports the decision.
Core rules and concepts
- The IR lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment can be short-term, such as isolation, and long-term, such as rebuilding.
- A SOC triages alerts using severity, asset criticality, and confidence. SIEM correlates logs; SOAR automates repetitive steps but still needs human approval for destructive actions.
- Evidence handling requires documented chain of custody, write blockers where appropriate, and copies rather than work on originals. Volatile data can be lost on shutdown.
- Playbooks make response consistent. Tabletop exercises test roles and communications. Metrics such as MTTD and MTTR measure detection and recovery, not just ticket volume.
- Communications must include legal, privacy, executive, and regulator paths when data or contracts require notification.
Worked example
A file server shows mass file renaming and a ransom note. First isolate the host from the network without powering it off, preserve logs and memory where policy allows, and identify the account and initial access. Check backups and whether they are immutable. Eradicate the persistence and vulnerable entry point, restore from a clean backup, and validate before reconnecting. Then notify according to legal and regulatory requirements.
Traps that cost marks
Do not wipe or reimage before preserving evidence. Do not pay the ransom as a technical containment step. Do not eradicate before containing spread. Do not confuse an alert with a confirmed incident.