Incident Handling and Response Procedures
Incident Handling and Response Procedures
This domain tests the mechanics of moving an incident from detection to recovery without destroying evidence or widening impact. Questions often ask you to choose a containment strategy, sequence response actions, or identify the incident commander's priority.
Core rules and concepts
- Follow the NIST phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Phases can overlap, but containment should be scoped before eradication.
- Containment options include isolating a host or VLAN, disabling an account, blocking a domain, revoking tokens, and segmenting network access. Short-term containment stops spread; long-term containment supports recovery.
- Eradication removes the root cause: malware, persistence, vulnerable service, or compromised credential. Recovery restores from trusted backups and validates that the threat is gone before reconnecting.
- The incident commander coordinates priorities, communication, and decisions. Technical leads execute; legal, privacy, and communications advise on obligations.
- Preserve evidence before destructive actions when policy and safety allow. Document every action with time, actor, and result.
Worked example
Ransomware is detected on a file server. Reasoning: first isolate the server's network segment and disable compromised service accounts to stop encryption spread. Do not immediately delete files or reformat; preserve memory and logs if the response plan allows. Scope by checking SMB sessions, backup integrity, and other hosts for the same binary. Eradicate by removing persistence and rebuilding from a known-good image; recover from offline backups; validate with scans and monitoring before restoring access. Then hold a post-incident review.
Traps
Do not power off or wipe a host before preserving volatile data unless safety requires it; do not reconnect a recovered host without validation; do not let communications run ahead of verified facts.