Lesson 6.3: Running an incident
Incident response is a sequence where order matters: collect what disappears first, contain without destroying evidence, preserve, then eradicate, recover and learn. NIST SP 800-61 (revised in 2025 to follow the Cybersecurity Framework 2.0) and RFC 3227's order of volatility are the reference points. In the lab you respond to the remote-access implant on app02 that Zeek exposed: record the live connection and process, cut the attacker off at the firewall, save and hash the implant, remove it and its service, and read the post-incident review's action items.
18 min
You will learn to
- Describe the incident response lifecycle
- Apply the order of volatility
- Contain without destroying evidence
- Preserve and hash artefacts before eradication
- Turn a post-incident review into actions
Key terms
- Incident response lifecycle
- Preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
- Order of volatility
- Collect the most short-lived evidence first: memory and network state, then processes, then disk, then logs and backups.
- Containment
- Stopping the attacker's ability to act while preserving evidence.
- Eradication and recovery
- Removing everything the attacker left, then restoring normal operation safely.
- Post-incident review
- A blameless meeting and document: what happened, what went well, what didn't, and actions with owners and dates.
← Security misconfiguration and exposed secrets · All lessons · Capstone: a cryptography health check →