5.8.1. The Incident Response Process

💡 First Principle: Incident response follows a structured lifecycle. Each phase has specific actions and objectives. Skipping phases or performing them out of order leads to extended damage, lost evidence, and repeated incidents.

Preparation — the most important phase. Develop the IR plan, assemble the team, establish communication channels, deploy tools, and train personnel. Preparation happens before incidents occur. Without it, everything else fails.

Detection — identifying that an incident has occurred through monitoring tools, alerts, user reports, or threat intelligence. Speed of detection directly affects the scope of damage.

Analysis — determining the scope, impact, and nature of the incident. What systems are affected? What data is at risk? What attack technique was used? Analysis informs the containment strategy.

Containment — limiting the damage by isolating affected systems, blocking malicious traffic, and preventing lateral movement. Short-term containment (isolate the system) precedes long-term containment (apply temporary fixes while maintaining business operations). Choosing a containment strategy means weighing potential damage, the need to preserve evidence, and service availability (NIST SP 800-61r2 §3.3.1). Analysis and containment overlap: once activity is confirmed as destructive and still spreading, contain it immediately rather than finishing the full investigation first. Prefer isolating a host from the network over powering it off, because a shutdown destroys volatile evidence in memory.

Eradication — removing the root cause: malware removal, patching exploited vulnerabilities, closing compromised accounts, eliminating attacker persistence mechanisms.

Recovery — restoring systems to normal operation: re-imaging compromised systems, restoring from backups, validating system integrity, monitoring for re-infection.

Lessons learned / Post-incident review — analyzing what happened, what worked, what failed, and what needs to change. Documents findings in a report and updates the IR plan, detection rules, and training. Without this phase, the organization repeats the same mistakes.

Reporting and notification — incidents can trigger legal and contractual reporting duties. For example, GDPR Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach; details may follow in phases. The IR plan defines in advance who decides and who notifies (Preparation), the clock runs from awareness so scoping facts must be gathered during analysis, and the completed breach report and regulator follow-up sit with the post-incident documentation.

⚠️ Exam Trap: The exam uses the NIST incident response lifecycle. Preparation comes first. Lessons learned comes last and feeds back into preparation. If a question asks "what should be done FIRST after a breach is discovered?" — it's detection and analysis (assessing the scope), NOT containment. You need to understand the incident before you can contain it effectively.