Incident Response & Monitoring

Definitions

Event (any occurrence) → incident (threat to confidentiality, integrity, or availability) → breach (unauthorized access to protected data).

Monitoring

Logging · security information and event management (SIEM) correlation · security operations center · intrusion detection and prevention · data loss prevention · threat intelligence.

Life cycle (National Institute of Standards and Technology (NIST) 800-61)

1. Preparation (plan, team, tabletop exercises)
2. Detection and analysis
3. Containment (isolate, preserve evidence)
4. Eradication (remove cause)
5. Recovery (clean backups, monitor)
6. Lessons learned

Evidence

Forensic images, hash verification, chain of custody.

Notification

• Securities and Exchange Commission (SEC) 8-K: 4 business days after materiality determination.
• General Data Protection Regulation (GDPR): 72 hours to regulator.
• Health Insurance Portability and Accountability Act (HIPAA): within 60 days.
• States: varies (often 30–60 days).

Exam traps

• Contain before you eradicate — cut off the attacker's access first, then remove the cause.
• Preserve evidence before wiping systems; reimaging first destroys forensic evidence.
• Restore only from backups known to be clean — ransomware may have been dormant in recent backups.