Incident Response and Containment
What the domain tests
Incident response and containment: the IR lifecycle, evidence-preserving containment, notification, eradication, recovery, and lessons learned, tied to PCI DSS Requirement 12.10.
Core rules
- Phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment buys time; it is not eradication.
- Containment options: isolate at the switch or firewall, block C2, disable compromised accounts, and segment the CDE. Capture memory and relevant logs before shutdown or reimage.
- Preserve evidence: image before rebuild, retain original media, document actions, and maintain chain of custody. Do not wipe the only copy.
- Notification: internal escalation, acquirer/processor, card brands through the acquirer, legal/privacy, law enforcement where appropriate, and PCI SSC via the PFI process. Do not wait for perfect attribution if card data may be at risk.
- Eradication: remove malware, patch the entry point, reset credentials, rebuild compromised hosts, and validate. Recovery: monitor for re-infection and confirm controls.
Worked example
A merchant detects POS malware. The team isolates the POS VLAN, blocks the C2 IP, captures memory from one terminal, images disks, resets service and admin accounts, and notifies the acquirer, which engages a PFI. Reasoning: isolation limits spread; memory capture preserves track-data evidence; account resets close the access path; notification starts the PFI process. Reimaging before imaging would destroy evidence.
Traps
Reimaging immediately; believing C2 blocking ends the incident; notifying only after confirmed PAN theft; treating containment as eradication; calling law enforcement before preserving evidence; skipping lessons learned.