Lesson 4.4: Incident response: prepare, detect, contain, eradicate, recover, learn
What an incident is, the incident response life cycle (NIST SP 800-61: preparation; detection and analysis; containment, eradication and recovery; post-incident activity) and why the order matters. In the lab you handle a real-looking case from start to finish: an unknown connection to an outside address, the process behind it, how it survives reboots, cutting it off, saving evidence before deleting anything, removing it, checking it's gone and writing the first line of the report.
20 min
You will learn to
- Tell an event from an incident
- Name the phases of incident response in order
- Trace a suspicious connection to a process and its persistence
- Contain before eradicating, and preserve evidence first
- Verify the clean-up and record what happened
Key terms
- Event and incident
- An event is anything that happens on a system (a login, a connection). An incident is an event that harms or threatens confidentiality, integrity or availability.
- Incident response (IR)
- The planned way an organisation handles an incident, from first alert to lessons learned.
- Containment
- Stopping the incident from spreading or doing more damage, without destroying evidence.
- Eradication and recovery
- Removing the cause (malware, accounts, holes), then returning systems to normal and watching them.
- Persistence
- How malware or an attacker makes sure they come back after a reboot or a kill.
- Indicator of compromise (IoC)
- A clue that a system was attacked, which can be searched for elsewhere.
- Evidence
- Copies, hashes and notes that show what happened, kept unchanged.
← More ways to look at text: head, tail, wc, sort and uniq · All lessons · Hard and symbolic links →