Incident Response Flashcards
Incident
Act of violating an explicit or implied security policy.
Incident Response Procedures
Guidelines for handling security incidents
What are the 7 Incident Response Phases?
Preparation
Detection
Analysis
Containment
Eradication
Recovery
Post-Incident Activity or Lessons Learned
Preparation
Stage 1 of IRP
Involves strengthening systems and networks to resist attacks. All about getting ready for future incidents.
Detection
Stage 2 of IRP
Identifies security incidents
Analysis
Stage 3 of IRP
Involves a thorough examination and evaluation of the incident.
Stakeholders are informed, containment begins, and initial response actions are taken.
Containment
Stage 4 of IRP
Limits the incident’s impact by securing data and protecting business operations.
Eradication
Stage 5 or IRP
Starts after containment and aims to remove malicious activity from the system or network.
Recovery
Stage 6 of IRP
Restores systems and services to their secure state after an incident.
Restoring from a known good backup, installing security patches, and implementing configuration updates.
Recovery procedures can involve monitoring for lingering threats to ensure a smooth return to normal operations.
Post-Incident Activity or Lessons Learned
Stage 7 of IRP
Happens after containment, eradication, and full system recovery.
Root Cause Analysis to identify the incident’s source and how to prevent it in the future. Determine the casual relationships that led to the incident, identify a practical solution, and implement and track the solutions.
Lessons Learned Process - Documents experiences during incidents in a formal way
After-Action Report - collects formalized information about what occurred.
Digital Forensics
Process for investigating and analyzing digital devices and data to uncover evidence for legal purposes.
Identification
Ensured the safety of the scene, secures it to prevent any evidence contamination, and determines the scope of the evidence to be collected.
Collection
Refers to the process of gathering, preserving, and documenting physical or digital evidence in various fields.
Order of Volatility
Dictates the sequence in which data sources should be collected and preserved based on their susceptibility to modification or loss
NIST 800-56 Steps:
Collect data from systems’ memory
Capture data from the system state
Capture data from the storage devices
Capture network traffic and logs
Collect remotely stored or archived data
Chain of Custody
A documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law.
