Incident Response

# Incident response - defender perspective

> Authorised work only. This page describes IR practice from a defender
> point of view. Live IR engagements require an executed engagement letter,
> scope, and legal coordination.

## The IR lifecycle (NIST 800-61)

1. Preparation - tools, runbooks, training, contracts in place before incidents
2. Detection + analysis - confirm there is an incident; scope it
3. Containment - short-term + long-term; preserve evidence
4. Eradication - remove the foothold (creds, persistence, malware)
5. Recovery - restore systems, monitor for re-entry
6. Lessons learned - blameless post-mortem with action items

## Preparation checklist

- Out-of-band comms (Signal, separate Slack workspace) for cases where corp comms are compromised
- Engagement letter pre-negotiated with an IR retainer firm
- Cyber insurance carrier + breach counsel pre-identified
- Forensic image collection capability (KAPE, FTK Imager, AWS EBS snapshots)
- Runbooks for top scenarios: BEC, ransomware, cloud credential compromise, insider threat
- Tabletop exercises quarterly with execs and legal

## Containment principles

- Preserve evidence before containment (memory + disk images)
- Network-isolate, do not power off (volatile memory matters)
- Rotate credentials of confirmed-compromised accounts immediately
- Block known-bad indicators at the edge (DNS, firewall) once it does not tip off the actor

## Eradication + recovery

- Rebuild affected hosts from clean images
- Reset everything the compromised identity could touch (downstream tokens, OAuth grants)
- Verify backups before restore; isolate restore env from production
- Monitor for re-entry for at least 30 days

## Post-incident

- Blameless post-mortem within 5 business days
- Detection + prevention gaps tracked as engineering work
- Customer comms reviewed by legal + counsel before sending
- Public disclosure decisions per legal counsel

## Common mistakes

- Powering off compromised hosts (loses memory evidence)
- Skipping legal counsel before customer comms
- Skipping insurance carrier notification (may invalidate cover)
- 'Just rotating the password' instead of fully revoking sessions + tokens

# IR phases (NIST):
#   Prepare → Detect → Analyse → Contain → Eradicate → Recover → Lessons learned.
# Run table-tops quarterly. Document playbooks per incident class.