Security Incident Response

A security incident is not a question of “if” but “when.” The difference between a minor event and a career-ending breach is the speed and quality of the response. Organizations with a practiced incident response plan contain breaches 54% faster (IBM Cost of a Data Breach Report).

---

NIST Incident Response Lifecycle

1. Preparation → 2. Detection & Analysis → 3. Containment → 
4. Eradication → 5. Recovery → 6. Post-Incident Activity

---

Preparation

Incident Response Team

Incident Commander (IC):
  - Coordinates response, makes key decisions
  - Single point of authority

Technical Lead:
  - Leads investigation and forensics
  - Directs containment and eradication

Communications Lead:
  - Internal communications (status updates)
  - External communications (customers, regulators)
  
Legal/Privacy:
  - Regulatory notification requirements
  - Evidence preservation guidance

Subject Matter Experts (as needed):
  - Database, network, application SMEs
  - Cloud infrastructure specialists

Pre-Incident Checklist

preparation:
  tools:
    - SIEM with detection rules (Splunk, Sumo Logic)
    - EDR on all endpoints (CrowdStrike, Carbon Black)
    - Network traffic analysis (Zeek, Suricata)
    - Forensics toolkit (disk imaging, memory analysis)
    - Secure communication channel (separate from compromised systems)
    
  access:
    - Break-glass accounts for emergency access
    - Pre-authorized cloud API credentials
    - VPN access for remote investigators
    
  documentation:
    - System architecture diagrams
    - Network topology maps
    - Data flow diagrams (where does PII live?)
    - Vendor contact list for support
    
  practice:
    - Quarterly tabletop exercises
    - Annual full-scale simulation
    - New team member training

---

Detection & Analysis

Severity Classification

Severity	Definition	Response Time	Example
Critical	Active data breach, system compromise	< 15 min	Ransomware, data exfiltration
High	Confirmed threat, no active breach yet	< 1 hour	Compromised credentials, malware
Medium	Suspicious activity, investigation needed	< 4 hours	Unusual access patterns, phishing
Low	Minor security event, no immediate threat	< 24 hours	Policy violation, expired certificate

Initial Triage

Within first 15 minutes:
  1. What happened? (alert description, initial evidence)
  2. When did it start? (first evidence timestamp)
  3. What is affected? (systems, data, users)
  4. Is it ongoing? (active attacker vs historical compromise)
  5. What is the blast radius? (how bad could it get?)

---

Containment

Short-term containment (stop the bleeding):
  - Isolate compromised systems (network segmentation)
  - Block attacker IPs/domains
  - Disable compromised accounts
  - Revoke compromised credentials
  
  DO NOT:
  - Shut down systems (destroys volatile evidence)
  - Reinstall without imaging (destroys forensic evidence)
  - Alert the attacker that you know (they may escalate)

Long-term containment:
  - Implement temporary firewall rules
  - Deploy additional monitoring
  - Create clean segments for critical systems
  - Maintain evidence chain of custody

---

Communication Templates

Internal Status Update:
  Subject: [INC-2026-042] Security Incident Update #3
  Severity: HIGH
  Status: CONTAINMENT IN PROGRESS
  
  Summary:
  At 14:32 UTC, we detected unauthorized access to the staging 
  database via compromised service account credentials. The 
  account has been disabled and the staging environment isolated.
  
  Impact:
  - Staging database (no customer data)
  - No production systems affected
  - No customer data exposure confirmed
  
  Actions taken:
  - Compromised credentials revoked
  - Staging network isolated
  - Forensic imaging in progress
  
  Next update: 18:00 UTC or sooner if material changes

---

Anti-Patterns

Anti-Pattern	Consequence	Fix
No incident response plan	Chaotic response, extended damage	Documented IR plan + regular practice
Blame culture	People hide incidents	Blameless culture, focus on learning
No forensic preservation	Cannot determine scope of breach	Image systems before remediation
Alert the attacker	Attacker escalates, covers tracks	Contain silently, investigate first
Skip post-incident review	Same incident happens again	Mandatory post-incident review

Incident response is a muscle. It atrophies without practice. The organizations that handle incidents well are the ones that prepare, practice, and improve continuously.