Incident Response and Business Continuity
Core ideas
Incident response follows a lifecycle: prepare, detect/identify, contain, eradicate, recover, lessons learned. Containment can be short-term (isolate host) or long-term (rebuild). Preserve evidence with chain of custody. Business continuity (BC) keeps critical functions running; disaster recovery (DR) restores IT. Know RTO (max tolerable downtime), RPO (max tolerable data loss), and MTD/MTTR.
Concepts to master
Incident classification and escalation; communication plans. Backup types (full, incremental, differential) and the 3-2-1 rule. Site strategies (hot/warm/cold), redundancy, and failover. Tabletop exercises and BC/DR testing. Forensic order of volatility (collect volatile data first: memory, then disk).
Traps
Don't power off a compromised host before capturing memory-it destroys volatile evidence. RTO is about time to restore; RPO is about data loss tolerance. Incremental backups need the last full plus all incrementals; differential needs the last full plus the latest differential. Containment precedes eradication.
Worked example
A server is actively exfiltrating data. First contain (isolate from network) while preserving memory, then eradicate the malware, recover from clean backups, and conduct lessons learned. Restoring immediately without containment risks reinfection.
Rule of thumb: contain fast, preserve volatile evidence first, and always close with lessons learned.