Incident analysis begins after detection and initial documentation, not only after recovery. It establishes what happened, how it unfolded, which systems or data were affected, and what should change to prevent a recurrence. The findings also help prioritize the response and allocate resources. section 9.5 section 9.12
Work from evidence toward decisions:
- Collect system logs, network traffic, security alerts, and other relevant records. section 9.5
- Correlate records for indicators of compromise, such as unauthorized access attempts, unusual traffic, or unexpected file changes. section 9.5
- Reconstruct a timeline covering detection, subsequent activity, and response actions to investigate the cause. section 9.5
- Assess affected systems and data, breach extent, and business and operational effects; use that assessment to prioritize action. section 9.5
Financial institution data breach
Unusual traffic from an internal server led investigators to logs showing unauthorized login attempts and customer data transferred to an external IP address. A timeline linked a phishing email, compromised employee credentials, server access, and exfiltration. More than 10,000 customers’ personal information was compromised. The phishing email was the entry point; missing multifactor authentication for remote access was a critical weakness. Corrective actions included remote-access MFA, stronger email filtering, staff training, and improved network monitoring. section 9.5.1
Carry findings into follow-up work. Compare incident metrics with targets and record deviations to guide correction plans. Debrief the communication process separately: document what worked, improve what did not, and incorporate lessons into training and exercises. section 9.5.4 section 9.6
