GO KALI FREE
AdvancedSecurity Operations

Incident Response: Structured Approach to Security Breaches

Learn the incident response lifecycle including preparation, detection, containment, eradication, recovery, and lessons learned with practical frameworks and real-world scenarios.

#Incident Response#IR#Security Breach#SOC#Containment

When a Hospital Had Minutes to Decide

In 2017, the NotPetya attack hit pharmaceutical giant Merck, causing $1.4 billion in damage. In the first minutes, IT teams had to decide: disconnect servers to contain the spread (and halt global operations) or leave systems online to preserve evidence (and risk total encryption). This split-second decision is why incident response exists — a structured, pre-planned approach that replaces panic with procedure. Organizations with mature IR capabilities contain breaches 60% faster and save millions in breach costs.

Incident Response (IR) is the structured approach to managing and addressing security breaches. A well-defined IR process minimizes damage, reduces recovery time and costs, preserves evidence, and prevents future incidents.

Prerequisites

  • **Security Monitoring** — Understanding of detection capabilities
  • **SIEM Fundamentals** — Familiarity with alerting and logging
  • **Digital Forensics Basics** — Evidence handling and preservation

    • The Incident Response Lifecycle

    The NIST SP 800-61 framework defines four IR phases, while SANS PICERL defines six. We cover the six-phase SANS model for comprehensiveness.

    Phase 1: Preparation

    The most critical phase. Organizations with prepared IR teams respond faster and more effectively.

    Key Activities:

  • Develop and maintain IR policies and procedures
  • Build an IR team with defined roles (incident coordinator, technical lead, communications lead)
  • Provision tools (forensic workstations, imaging hardware, analysis software)
  • Establish communication channels (secure chat, phone bridges, encrypted email)
  • Conduct tabletop exercises and simulations
  • Create playbooks for common scenarios (ransomware, phishing, data exfiltration)
    • # Preparation: Create forensic response toolkit
# Tools to have ready on forensic workstation
sudo apt install sleuthkit autopsy volatility guymager

    Phase 2: Identification

    Detection and initial assessment of potential incidents.

    Key Activities:

  • Triage alerts from SIEM, EDR, and other sources
  • Validate if an incident is actually occurring (eliminate false positives)
  • Determine scope: what systems, users, and data are affected
  • Assess severity: critical, high, medium, or low
  • Escalate according to the IR plan

    • Indicators of Compromise (IOCs):

  • Unusual outbound network connections
  • Unexpected system processes
  • New user accounts or group membership changes
  • Antivirus/EDR alerts on known malware
  • Unusual database query volumes
  • Ransom notes or encryption activity

    • Phase 3: Containment

    Stop the incident from spreading and limit damage.

    Short-term Containment:

  • Isolate affected systems from the network
  • Disable compromised accounts
  • Block malicious IPs at the firewall
  • Take systems offline if necessary

    • Long-term Containment:

  • Apply temporary security patches
  • Implement additional monitoring on unaffected systems
  • Rotate credentials for potentially compromised accounts
    • # Block malicious IP at firewall
iptables -A INPUT -s 192.168.1.100 -j DROP
iptables -A OUTPUT -d malicious-c2.com -j DROP

# Disable compromised account
net user compromised_user /domain /active:no

    Phase 4: Eradication

    Remove the threat from the environment entirely.

    Key Activities:

  • Remove malware from affected systems
  • Patch vulnerabilities that were exploited
  • Delete attacker-created accounts and backdoors
  • Reset credentials for all affected accounts
  • Verify persistence mechanisms are removed

    • Important: Eradication often involves rebuilding systems from known-good backups or re-imaging workstations entirely.

    Phase 5: Recovery

    Restore affected systems to normal operation.

    Key Activities:

  • Restore systems from clean backups
  • Monitor restored systems for signs of re-infection
  • Gradually return systems to production
  • Communicate restoration status to stakeholders
  • Implement additional security controls based on findings

    • Phase 6: Lessons Learned

    The most often skipped but most valuable phase.

    Key Activities:

  • Conduct post-incident review within 1-2 weeks
  • Document timeline, actions taken, and outcomes
  • Identify what worked and what didn't
  • Update playbooks and procedures
  • Implement improvements to prevent recurrence
  • Report to management on findings and recommendations

    • Incident Severity Levels

    | Level | Description | Response Time |

    |-------|-------------|---------------|

    | L1 | Phishing, low-impact malware | 4 hours |

    | L2 | Worm, targeted attack, data exfiltration | 2 hours |

    | L3 | Ransomware, APT, critical system compromise | Immediate |

    Real-World Example: Ransomware Incident Response

    Scenario: A hospital detects ransomware encrypting file servers.

  • **Detection**: EDR alerts on multiple systems executing suspicious PowerShell commands
  • **Containment**: IR team immediately isolates affected servers by disconnecting network cables and disabling switch ports
  • **Assessment**: 12 servers encrypted; patient data confirmed on encrypted drives; backup systems verified intact
  • **Eradication**: Affected systems rebuilt from clean images; root cause identified as phishing email
  • **Recovery**: Data restored from backups (verification process takes 48 hours); systems returned to production
  • **Lessons Learned**: Phishing training enhanced; email filtering strengthened; MFA deployed for all remote access
  • **Outcome**: No ransom paid; patient care minimally disrupted; operation cost $200K vs $5M potential ransom

    • Common Mistakes

  • **Skipping preparation** — Without preparation, response is chaotic and ineffective
  • **Not preserving evidence** — Destroying evidence during response prevents prosecution and analysis
  • **Isolating systems without preserving volatile data** — Memory and process information lost when powering off
  • **Focusing only on technical recovery** — Ignoring communications, legal, and PR aspects
  • **Not conducting lessons learned** — Repeating the same mistakes in future incidents
  • **Destroying evidence before legal review** — Evidence may be needed for prosecution

    • Best Practices

  • **Prepare before incidents occur** — Build IR plans, teams, and playbooks in advance
  • **Practice regularly** — Conduct tabletop exercises and simulated incidents quarterly
  • **Document everything** — Timelines, actions, decisions, and evidence preservation
  • **Preserve evidence** — Follow chain of custody for forensic data
  • **Communicate clearly** — Keep stakeholders informed without speculation
  • **Learn and improve** — Every incident is an opportunity to strengthen defenses
  • **Automate where possible** — Automated containment can stop attacks in seconds

    • Related Tools

  • **TheHive** — Open-source IR platform
  • **DFIRTrack** — IR case management
  • **Velociraptor** — Endpoint visibility and IR
  • **GRR Rapid Response** — Remote live forensics
  • **Cortex** — Observable analysis and response
  • [SMBClient](/tools/smbclient) — SMB share access for evidence collection

    • Related Articles

  • Security Monitoring: Building Detection Capabilities
  • SIEM Fundamentals: Security Information and Event Management
  • Digital Forensics Basics: Collecting and Analyzing Evidence
  • Threat Hunting: Proactive Cyber Defense Strategies
  • Detection Engineering: Creating Security Alerts and Rules

    • Summary

    Incident Response is a structured lifecycle with six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Preparation is the most critical phase. Effective IR requires defined procedures, trained teams, proper tools, preservation of evidence, clear communication, and continuous improvement through lessons learned.

    Knowledge Check

  • What are the six phases of the SANS IR lifecycle?
  • Why is the preparation phase most critical?
  • What is the difference between short-term and long-term containment?
  • Why is evidence preservation important during IR?
  • What should be the outcome of the Lessons Learned phase?

    • References

    {@ref nist-csf}

    {@ref mitre-attack-enterprise}

    Frequently Asked Questions

    What is the SANS incident response lifecycle?

    The SANS PICERL framework defines six IR phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Each phase has specific activities that guide teams through structured breach response, reducing damage and recovery time.

    Why is the preparation phase considered most critical?

    Preparation establishes the policies, teams, tools, and playbooks needed before an incident occurs. Organizations with mature preparation respond 60% faster and save millions in breach costs because their teams know exactly what to do when an attack happens.

    What is the difference between short-term and long-term containment?

    Short-term containment immediately stops the incident from spreading (isolating systems, blocking IPs, disabling accounts). Long-term containment applies temporary patches and additional monitoring while maintaining business operations during investigation.

    What is the order of volatility in incident response?

    Evidence must be collected from most volatile to least volatile: CPU registers, RAM, network state, running processes, disk storage, and archived data. Collecting volatile data first prevents loss of critical evidence when systems are powered off.

    How should organizations handle ransomware incidents?

    Isolate affected systems immediately without powering them off (to preserve memory), verify backup integrity, identify the attack vector, rebuild from clean images, and restore data from backups. Never pay the ransom as it funds criminal operations and does not guarantee data recovery.

    What tools are commonly used in incident response?

    Common IR tools include TheHive (case management), Velociraptor (endpoint visibility), GRR Rapid Response (live forensics), and Cortex (observable analysis). Forensic workstations should have Sleuthkit, Autopsy, and Volatility pre-installed for memory and disk analysis.

    What are common indicators of compromise (IOCs)?

    IOCs include unusual outbound network connections, unexpected processes, new user accounts, antivirus alerts, unusual database query volumes, and ransom notes. These signals help identify whether a breach is actively occurring and guide containment decisions.

    Why must evidence be preserved during incident response?

    Evidence preservation maintains the chain of custody needed for legal proceedings and forensic analysis. Destroying evidence during response can prevent prosecution of attackers and limit the organization's ability to understand the full scope of the breach.

    What is a tabletop exercise in incident response?

    A tabletop exercise is a simulated incident discussion where IR team members walk through a scenario without actually executing technical responses. It tests communication, decision-making, and procedure adherence, helping teams identify gaps before real incidents occur.

    How does incident response differ from disaster recovery?

    Incident response focuses on containing and eradicating security threats while preserving evidence. Disaster recovery focuses on restoring business operations and data after any type of disruption. IR is security-specific; DR covers all business continuity events.