5 Incident Response

Incident response is the structured way organizations deal with unwanted events that can disrupt operations or damage assets. The text explains that not every event is an incident, but some events become alerts or security incidents when they suggest harm to confidentiality, integrity, or availability. Because cyberattacks, human error, hardware failures, and environmental problems can all create serious consequences, organizations need a disciplined response approach to reduce downtime, limit losses, and restore normal business functions quickly.

The core response process is organized into four connected phases: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Preparation focuses on strengthening defenses, building an incident response plan, training an incident response team, and running drills. Detection and analysis use tools such as SIEM, SOAR, EDR/XDR, and IDS/IPS to identify suspicious activity, while analysts investigate false positives and false negatives, collect evidence, and determine the scope and source of the problem. Containment limits spread, eradication removes the root cause, and recovery restores systems securely, often from clean backups and with additional safeguards in place.

The chapter also emphasizes that incident response depends on organization and coordination. A formal incident response plan defines roles, procedures, communication methods, and detection mechanisms, while a Security Operations Center provides the tiered structure for handling incidents efficiently, with junior analysts escalating complex cases to more experienced staff. After an incident, teams review what happened, measure performance, preserve evidence appropriately, and use lessons learned to improve future readiness. Overall, the chapter presents incident response as a continuous cycle of preparation, action, review, and improvement.

Illustration of the incident response life-cycle.

Illustration of the Security Operation Center structure

1. The correct answer is A. The components commonly found in an incident response plan are (in this order): Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.
2. The correct answer is C. An incident is an unplanned event that could impact the confidentiality, integrity, or availability of information or information systems, and requires a response to mitigate or resolve the incident. Conducting an unauthorized vulnerability scan is considered a computer security incident because it involves an unauthorized activity that could potentially identify weaknesses in a system or network that could later be exploited by a threat actor.
3. The correct answer is B. Forensic investigation in incident response during the analysis phase is primarily concerned with collecting, preserving, and ensuring the admissibility of evidence for legal proceedings. While incident response includes tasks such as identifying attackers, documenting lessons learned, and minimizing impact, these are secondary to the primary purpose of forensic investigations.
4. The correct answer is C. During the containment phase of incident response, security administrators aim to minimize the impact by containing and isolating the incident while implementing temporary fixes. Detection identifies incidents, response involves immediate action, and recovery focuses on restoring systems and implementing long-term solutions to prevent recurrence.
5. The correct answer is D. In the recovery phase, systems are restored to regular operation, and long-term fixes are applied to prevent similar incidents, guided by the lessons learned from the incident. While detection, analysis, and mitigation are critical steps, they're not the right time to implement long-term solutions, which should be done during the recovery phase to prevent recurrence.

FAQ