6 Incident Response

 

This chapter covers

  • The difference between events, incidents, and security incidents
  • The four phases of the Incident Response Lifecycle
  • The Incident Response Plan
  • Organization of the Security Operations Center (SOC)

While risk management seeks to lower the likelihood and minimize the impact of risks, some risks can never be completely eliminated. Undesired events in the form of cyberattacks or equipment failures will make risks materialize and can cause significant damage if not resolved effectively. We will call such an incident to any undesired event that causes or has the potential to cause disruption or damage.

To protect themselves from disruptions to their business operation and damages to assets, organizations implement an incident response strategy that detects incidents and then takes action to mitigate, contain, and resolve them. A central aspect to this strategy is the creation and maintenance of an incident response plan, collecting data and feedback to continually improve it, and organizing teams around it.

This chapter will present the concepts related to incident response and their role in safeguarding organizational security. We will examine each key stage of the incident response process—including preparation, identification, containment, eradication, recovery, and lessons learned. Additionally, we will become familiar with common types of security incidents and learn how to appropriately respond to each scenario.

6.1 Why Is Incident Response Important?

6.2 Events, Incidents, and Security Incidents

6.3 Incident Response Lifecycle

6.3.1 Preparation

6.3.2 Detection and Analysis

6.3.3 Containment, Eradication, and Recovery

6.3.4 Post-Incident Activity

6.4 Incident Response Plan

6.5 The Security Operations Center (SOC)

6.5.1 SOC Structure

6.5.2 Escalation

6.6 Summary