Incident Response

Overview

Incident response is the organized process of preparing for, identifying, investigating, containing, removing, recovering from, and learning from cybersecurity incidents.

Key concepts

Preparation through lessons-learned phases
Triage, severity, containment actions
Forensics, chain of custody, root cause

How it works

Incident response is the organized process of preparing for, identifying, investigating, containing, removing, recovering from, and learning from cybersecurity incidents. An incident might involve malware, ransomware, phishing, account compromise, unauthorized access, data exposure, denial-of-service activity, insider misuse, or exploitation of a vulnerability.

The IR phases

Phase	What happens
Preparation	Creating policies, playbooks, contact lists, backups, logging, secure configurations, monitoring tools, and training before an incident occurs.
Detection & analysis	Identifying suspicious activity, validating whether an incident occurred, determining severity, collecting evidence, understanding scope.
Containment	Limiting spread and impact — isolating a device, disabling an account, blocking a domain, restricting network access.
Eradication	Removing the cause — malware, unauthorized accounts, malicious persistence, vulnerable software, unsafe configurations.
Recovery	Restoring normal operations, monitoring affected systems, validating controls, safely returning systems to service.
Lessons learned	Reviewing what happened, documenting gaps, improving defenses, updating procedures, testing changes.

Core IR terms

Term	Meaning
Security incident	A confirmed or suspected event threatening the confidentiality, integrity, or availability of systems or data.
Triage	Prioritizing and investigating an alert/incident based on severity and potential impact.
Severity	How serious an incident is, based on affected systems, data sensitivity, business impact, attacker access, and spread potential.
Containment action	A defensive action to reduce harm — isolating a host, disabling an account, blocking a malicious IP.
Forensics	Collecting and analyzing digital evidence to understand what happened.
Chain of custody	Documentation showing how evidence was collected, stored, accessed, and preserved.
Root cause	The underlying weakness, error, or vulnerability that allowed the incident to occur.
Post-incident review	A structured review identifying successes, failures, and improvements after an incident.