4.8 Incident response explained

Objective 4.8 covers what happens once something goes wrong. Many questions describe an action and ask which phase it belongs to, so learn the phases in order and what each one is for.

Preparation comes first: plans, contact lists, tools, training and the authority to act. Detection is noticing that something is happening. Analysis confirms it is a real incident and works out its scope. Containment limits the damage, for example by isolating a host or disabling a compromised account, while keeping evidence intact where possible. Eradication removes the cause, such as malware and any persistence it set up. Recovery restores systems to normal operation and watches them closely. Lessons learned is a review after the incident to improve plans and controls.

Training and testing keep the team ready. A tabletop exercise talks through a scenario without touching systems. A simulation carries out response actions against simulated attack activity, which tests people and tools for real. Root cause analysis looks for the underlying weakness that let the incident happen, so the fix prevents a repeat rather than only cleaning up. Threat hunting is proactive: analysts form a hypothesis about how an attacker might already be inside and search for evidence, instead of waiting for an alert.

Digital forensics is the other half of the objective. A legal hold suspends normal deletion for data related to a legal matter. Chain of custody records every person who handled evidence, when and why, so it remains admissible. Acquisition collects evidence, following the order of volatility: the most short-lived data, such as memory and running state, comes before disk, and disk before backups. Reporting documents what was found. Preservation keeps evidence unaltered, typically by working on copies and hashing the original image. E-discovery is the process of finding and producing electronic records for a legal case.

A common trap is jumping to eradication. When malware is confirmed, the first move is to contain it. Another trap is powering a system off too early, which destroys memory evidence. Containment by isolating the network connection while leaving the machine running is often the better first step.