Incident response

This objective covers Incident Response (IR) and Digital Forensics. When a preventive boundary fails, an organization relies on its IR plan to systematically minimize damage, restore services safely, and preserve evidence for potential legal proceedings.

1. The Incident Response Lifecycle (The Process)

CompTIA strictly follows the standard incident response phases defined by NIST (SP 800-61). You must know the exact order of these steps and what occurs within each phase.

 1. Preparation ➡️ 2. Detection & Analysis ➡️ 3. Containment ➡️ 4. Eradication ➡️ 5. Recovery ➡️ 6. Lessons Learned

Phase 1: Preparation

This is the continuous, proactive phase that happens before an attack occurs. It involves building the team, writing policies, establishing communication channels, and deploying monitoring tools (like SIEM and EDR).

Phase 2: Detection

The moment a potential security incident is identified through alerts, log analysis, firewall flags, or user reports.

Phase 3: Analysis

Determining the scope, severity, and legitimacy of the detection. Security analysts validate whether the alert is a true compromise or a false positive, identify what systems are involved, and document the attacker’s footprint.

Phase 4: Containment

The immediate, high-priority step taken to limit the blast radius of the breach and stop the attacker from moving laterally or stealing more data.

• Short-Term: Programmatically isolating a compromised endpoint from the network via EDR, or blocking a malicious IP at the perimeter firewall.
• Long-Term: Setting up sandboxed, mirrored environments to monitor the attacker’s methods or shifting production traffic away from affected zones.

Phase 5: Eradication

Completely removing the threat from the environment once it has been contained. This involves deleting malware, disabling compromised user accounts, closing exploited vulnerabilities, and wiping affected systems clean.

Phase 6: Recovery

Safely restoring affected systems back to normal production status. This involves restoring clean data from verified backups, rebuilding operating systems from secure baselines, continuously monitoring the recovered hosts for lingering signs of infection, and reopening services to users.

Phase 7: Lessons Learned

The final administrative phase, which must occur within days of the incident closing. The entire IR team, along with management, reviews the attack timeline. They document how the breach occurred (root cause analysis), what went wrong in their defense, and how the incident response plan can be modified to improve future reaction times.

2. Readiness: Training & Testing

An incident response plan is a liability if it is never practiced. Organizations evaluate their readiness using structural exercises:

• Training: Ensuring all members of the incident response team (including IT, HR, Legal, and PR) know their explicit communication protocols and responsibilities during a crisis.
• Tabletop Exercise: A conceptual, discussion-based classroom exercise. Key stakeholders sit around a conference table and walk through a simulated disaster scenario step by step to expose policy gaps without disrupting live production systems.
• Simulation: A hands-on, realistic exercise in which technical responders actively practice detection, containment, and recovery techniques in a sandboxed lab environment using real malware or attack frameworks.

3. Proactive Defenses & Analysis

• Root Cause Analysis (RCA): The systematic process of drilling down beyond the surface symptoms of an incident to identify the underlying vulnerability or process breakdown that allowed the attack to succeed in the first place.
• Threat Hunting: A highly proactive security practice in which analysts do not wait for an alert to be triggered. Instead, they operate under the assumption that an attacker is already inside the network undetected. They use advanced telemetry, log analytics, and threat intelligence to actively search for hidden, subtle indicators of compromise (IoCs).

4. Digital Forensics & Evidence Handling

When an incident has legal, regulatory, or criminal-law implications, the response must shift to strict Digital Forensics to preserve evidence so it remains fully admissible in a court of law.

• Acquisition: The technical process of collecting digital evidence from an asset. Responders must collect data following the Order of Volatility, capturing the most temporary data first before it disappears when a system loses power:
  1. CPU Registers and Cache memory
  2. System Memory (RAM)
  3. Network connections and process states
  4. Persistent Storage (Hard drives, SSDs)
  5. Long-term backups and archival storage
• Preservation: Ensuring the collected evidence is not altered. Forensics experts never examine or analyze a live evidence drive directly. Instead, they use a hardware write-blocker to create a perfect bitstream forensic image (clone) of the drive, compute a cryptographic hash value of the clone, and conduct all their analysis exclusively on the copy. If the hash value of the copy matches that of the original drive, it mathematically proves that the evidence was perfectly preserved without alteration.
• Chain of Custody: A meticulous, unbroken chronological log documenting exactly who physically handled, accessed, or transferred a piece of evidence from the moment it was collected until it arrives in court. If a single gap in this documentation is found, the evidence can be excluded from court as contaminated.
• Legal Hold: A formal directive issued by an organization’s legal counsel ordering the IT and security teams to immediately halt the routine automated deletion, recycling, or rotation of data (such as emails, chat logs, or backup tapes) because the information is relevant to active or pending litigation.
• E-Discovery (Electronic Discovery): The process of identifying, collecting, and reviewing electronic documents, emails, and data streams to produce them as evidence during legal discovery.
• Reporting: Documenting the forensic findings in a clear, completely objective, scientifically verifiable technical report that can be understood by judges, juries, and corporate executives.