Application security incident management and response
Scope
This domain covers incidents that affect applications: exploited vulnerabilities, data breaches, logic flaws, and third-party component failures. The exam expects you to connect application incident response to the organization's incident management process and to the Application Normative Framework (ANF).
Core rules
- Follow the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
- Use Application Security Controls (ASCs) for logging, monitoring, alerting, classification, and escalation.
- Define application-specific escalation paths and roles, including the application security manager.
- Preserve evidence for forensics and root-cause analysis.
- After the incident, update the ANF and Organization Normative Framework (ONF) with new or revised ASCs.
Worked example
A retail application is hit by SQL injection. A WAF alert and abnormal database logs trigger detection. Containment blocks the source and isolates the affected service. Eradication fixes the vulnerable query and adds parameterized queries. Recovery restores data and monitors for recurrence. Post-incident analysis adds an ASC for threat modeling during design and updates the ONF so other teams benefit.
Traps
Treating application incidents as purely infrastructure events misses application-layer causes. Closing an incident without updating the ANF/ONF means the same weakness recurs. Skipping root-cause analysis and evidence preservation weakens both response and audit readiness.