Principles of Information Security: Incident Response Lifecycle (Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned)

Incident Response Lifecycle (Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned)

Incident Response Lifecycle (IRL) – Exam-Ready Study Guide

For CISSP, Security+, CEH, and Real-World Security Roles

What This Is

The Incident Response Lifecycle (IRL) is a structured approach to detecting, managing, and recovering from security incidents (e.g., ransomware, data breaches, insider threats). It ensures organizations minimize damage, restore operations, and prevent future attacks.
Example: In 2021, the Colonial Pipeline ransomware attack (via a leaked VPN password) caused a 6-day shutdown—poor incident response worsened the impact. A well-executed IRL could have contained the attack faster, reducing downtime and financial loss.

Key Terms & Concepts

• Incident Response (IR): A coordinated effort to detect, analyze, and respond to security events that threaten confidentiality, integrity, or availability (CIA Triad). Standards: NIST SP 800-61, ISO 27035.
• Security Incident: A confirmed violation or imminent threat to security policies (e.g., malware infection, unauthorized access). Example: A phishing email leading to credential theft.
• SIEM (Security Information and Event Management): Tools (Splunk, IBM QRadar, Microsoft Sentinel) that aggregate logs, correlate events, and generate alerts for suspicious activity.
• Playbook: A predefined, step-by-step guide for responding to specific incident types (e.g., ransomware, DDoS). Example: "Ransomware Playbook: Isolate infected systems → Preserve logs → Engage legal/forensics."
• Containment: Short-term (e.g., disconnecting a device) and long-term (e.g., patching vulnerabilities) actions to stop an incident from spreading. NIST phases: Short-term (tactical) vs. long-term (strategic).
• Eradication: Removing the root cause of an incident (e.g., deleting malware, revoking compromised credentials). Tools: Antivirus (CrowdStrike), EDR (SentinelOne), forensic tools (FTK, Autopsy).
• Recovery: Restoring systems to normal operations while ensuring they’re secure (e.g., restoring from clean backups, validating patches). Key: Avoid reintroducing vulnerabilities.
• Lessons Learned (Post-Incident Review): A meeting to analyze what happened, why, and how to improve. Output: Updated playbooks, training, or policy changes.
• CSIRT (Computer Security Incident Response Team): The cross-functional team (IT, legal, PR, forensics) responsible for IR. Roles: Incident Manager, Forensic Analyst, Communications Lead.
• IOC (Indicator of Compromise): Artifacts (e.g., IP addresses, file hashes, registry keys) that suggest a system has been breached. Example: A known malicious IP in firewall logs.
• TTPs (Tactics, Techniques, and Procedures): How attackers operate (e.g., phishing → lateral movement → data exfiltration). Framework: MITRE ATT&CK.
• Chain of Custody: A documented trail proving evidence (e.g., logs, hard drives) hasn’t been tampered with. Critical for legal admissibility.

Step-by-Step / Process Flow

Follow this NIST-aligned lifecycle (6 phases):

1. Preparation

Goal: Build a proactive defense to prevent and respond to incidents.
- Actions:
- Develop an Incident Response Plan (IRP) (aligned with NIST SP 800-61 or ISO 27035).
- Define roles (CSIRT) and escalation paths (e.g., "Report phishing to SOC within 1 hour").
- Create playbooks for common incidents (ransomware, insider threats, DDoS).
- Deploy tools: SIEM, EDR, firewalls, and backup systems (3-2-1 rule: 3 copies, 2 media types, 1 offsite).
- Train staff via tabletop exercises (simulated attacks) and phishing tests.
- Establish communication plans (internal: IT, legal; external: customers, regulators).

2. Detection & Analysis

Goal: Identify and confirm an incident.
- Actions:
- Monitor alerts from SIEM, IDS/IPS (Snort, Suricata), and EDR tools.
- Triage alerts: False positive (e.g., benign admin activity) vs. true positive (e.g., brute-force attack).
- Gather evidence: Logs (Windows Event Logs, Sysmon), network traffic (PCAP), memory dumps (Volatility).
- Classify the incident (e.g., "Unauthorized Access – Severity: High").
- Document findings in an incident ticket (e.g., ServiceNow, Jira).

3. Containment

Goal: Limit damage and prevent further spread.
- Short-term (Tactical) Containment:
- Isolate affected systems (disconnect from network, disable RDP/SMB).
- Block malicious IPs/domains at the firewall (e.g., Palo Alto, pfSense).
- Revoke compromised credentials (e.g., reset passwords, disable accounts).
- Long-term (Strategic) Containment:
- Patch vulnerabilities (e.g., apply CVE-2023-XXXX patch).
- Deploy network segmentation (e.g., VLANs, micro-segmentation).
- Implement temporary workarounds (e.g., disable vulnerable services).

4. Eradication

Goal: Remove the root cause.
- Actions:
- Delete malware (use EDR tools like CrowdStrike or Malwarebytes).
- Remove backdoors (e.g., reverse shells, scheduled tasks).
- Sanitize systems (reimage infected machines or restore from clean backups).
- Validate eradication (scan with tools like Nessus or OpenVAS).

5. Recovery

Goal: Restore systems to normal operations securely.
- Actions:
- Restore from verified clean backups (test backups before recovery!).
- Rebuild systems from golden images (e.g., AWS AMIs, VM templates).
- Monitor for reinfection (e.g., SIEM alerts for unusual activity).
- Gradually reintroduce systems to production (e.g., "Canary deployments").

6. Lessons Learned

Goal: Improve future response.
- Actions:
- Hold a post-incident review (PIR) within 1–2 weeks.
- Document:
- What happened? (Timeline of events)
- What worked well? (e.g., "SIEM detected the attack in 10 minutes")
- What failed? (e.g., "Backup restoration took 12 hours due to untested procedures") - Update playbooks, policies, and training.
- Share findings with leadership and stakeholders (e.g., "We need to invest in EDR").

Common Mistakes

Certification Exam Tips

1. CISSP Trap: Questions may test management vs. technical perspectives.
2. Example: "What’s the primary goal of the Preparation phase?" → Management answer: "Develop an IR plan and train staff." Technical answer: "Deploy SIEM tools." (Correct: Management.)
3. Security+ Focus: Know the order of phases (Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned).
4. Trick question: "Which phase comes after containment?" → Eradication (not recovery!).
5. CEH Angle: Expect questions on attacker TTPs during Detection/Analysis.
6. Example: "An attacker uses Mimikatz to dump credentials. Which MITRE ATT&CK technique is this?" → Credential Dumping (T1003).
7. NIST vs. ISO: CISSP may ask about NIST SP 800-61 (IR) vs. ISO 27035 (incident management). Know both frameworks.

Quick Check Questions

1. A SOC analyst detects a ransomware infection on a file server. The team isolates the server and revokes compromised credentials. Which phase of the IR lifecycle is this?
2. A) Detection
3. B) Containment
4. C) Eradication

5. D) Recovery
   Answer: B) Containment. Explanation: Isolating systems and revoking credentials are short-term containment actions to limit damage.

6. During a post-incident review, the team discovers that backups were not tested before the ransomware attack, delaying recovery. Which phase of the IR lifecycle should address this gap?

7. A) Preparation
8. B) Lessons Learned
9. C) Eradication

10. D) Detection
    Answer: B) Lessons Learned. Explanation: The Lessons Learned phase identifies improvements (e.g., testing backups) to prevent future issues.

11. An organization’s IR plan states that all incidents must be reported to the CSIRT within 1 hour. Which key term describes this requirement?

12. A) Escalation Path
13. B) Chain of Custody
14. C) Playbook
15. D) IOC
    Answer: A) Escalation Path. Explanation: An escalation path defines who to contact and timelines for reporting incidents.

Last-Minute Cram Sheet

1. IR Lifecycle Phases (NIST): Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned.
2. Containment Types: Short-term (tactical) vs. long-term (strategic). ⚠️ Don’t confuse with eradication!
3. SIEM Tools: Splunk, IBM QRadar, Microsoft Sentinel, ELK Stack.
4. Forensic Tools: FTK, Autopsy, Volatility (memory analysis), Wireshark (PCAP).
5. MITRE ATT&CK: Framework for attacker TTPs (e.g., Phishing (T1566), Lateral Movement (T1021)).
6. Backup Rule: 3-2-1 (3 copies, 2 media types, 1 offsite).
7. Chain of Custody: Critical for legal admissibility of evidence.
8. Playbook: Step-by-step guide for specific incidents (e.g., ransomware, DDoS).
9. CSIRT Roles: Incident Manager, Forensic Analyst, Communications Lead.
10. NIST IR Standard: SP 800-61 (vs. ISO 27035). ⚠️ CISSP loves framework questions!