The incident response life cycle
- Preparation — plan, roles, contact lists, tooling, tabletop exercises
- Detection and analysis — identify and validate that an incident is occurring; determine scope
- Containment — short-term (isolate affected systems) and long-term (temporary fixes while rebuilding)
- Eradication — remove the root cause: malware, compromised accounts, exploited vulnerability
- Recovery — restore systems, validate integrity, monitor for recurrence
- Post-incident review — lessons learned; feed improvements back into preparation
IMPORTANT: Contain before you eradicate. Rushing to wipe systems can destroy forensic evidence and may not stop lateral movement already in progress. Preserving evidence and maintaining chain of custody matters if litigation or law enforcement involvement follows.
Monitoring and detection
- Logging — who did what, when. Logs must be protected from alteration by the very administrators they monitor
- SIEM (Security Information and Event Management) — aggregates and correlates logs across systems to detect patterns
- IDS/IPS — intrusion detection (alerts) vs. intrusion prevention (blocks)
- Vulnerability scanning — automated identification of known weaknesses
- Penetration testing — authorized simulated attack to test defenses in practice
Business continuity and disaster recovery
| Metric | Meaning |
|---|---|
| RTO (Recovery Time Objective) | How quickly the system must be back up |
| RPO (Recovery Point Objective) | How much data loss is tolerable — drives backup frequency |
Recovery site options: hot site (fully equipped, near-immediate), warm site (partially equipped), cold site (space and utilities only, cheapest and slowest).
EXAM TIP: An untested backup is not a control. Backups must be periodically restored and validated — and kept offline or immutable so ransomware can't encrypt them along with production data.