Incident Response and Handling
Incident Response and Handling
This domain tests the incident lifecycle, evidence handling, and the containment decisions that protect both the business and the investigation.
Core rules
- NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
- Follow order of volatility: CPU and cache, memory, swap, network connections, running processes, disk, remote logs, backups. Capture the volatile first.
- Chain of custody: document who handled evidence, when, and where; image disks with a write blocker and hash before and after.
- Classify severity early using agreed criteria (data sensitivity, scope, business impact) so escalation is not ad hoc.
- Containment options range from isolating a host to blocking an account to segmenting a network. Choose the least disruptive option that stops spread.
- Post-incident activity produces lessons learned and tracked corrective actions, not a closing email.
Worked example
Ransomware is detected on a file server. Powering it off would destroy memory-resident evidence and encryption keys. Instead, use EDR network containment to isolate the host while leaving it running, capture a memory image, pull EDR telemetry to find the initial access vector and other affected hosts, disable the compromised service account, then restore from backups validated as offline and uninfected.
Traps that cost marks
- Reimaging or wiping a host before imaging it, destroying evidence.
- Containment actions that alert the attacker or destroy volatile state.
- Declaring closure without lessons learned or corrective-action owners.
- Skipping documentation because the incident was "obvious".