5.2Incident response based on NIST SP800-61

Incident response descends into chaos usually because "which phase we are in and who does what next" is not shared. NIST SP800-61 systematizes this response as a four-phase lifecycle, providing a common language for when you are unsure. This section covers both the contents of the IR plan prepared in advance and the judgment of mapping an ongoing event to a phase to choose the next move. Even field tensions like "preserve evidence first or stop it first" become tractable once you understand the phases.

5.2.1Elements of an IR plan

• NIST SP800-61 lists elements an incident response plan should contain: mission, strategies and goals, senior management approval, the organizational approach to IR, communication between the IR team and the rest of the organization, metrics to measure maturity, a roadmap for maturing the program, and how the program fits into the overall organization. It matters that the plan is approved as a document and backed by authority.
• A plan, a procedure, and a policy are distinct: the policy states the "what should be done" principles, the plan provides the structure and big picture, and the procedure (playbook) gives the concrete steps of "who runs which commands for this event." The SOC can act without hesitation precisely because these three layers are prepared in advance.

5.2.2The four-phase lifecycle

• (1) Preparation—getting ready for incidents: forming the IR team, provisioning tools, writing playbooks, training, and preparing assets and communication paths. (2) Detection & Analysis—detecting events from alerts and logs and determining whether they are true positives, what the scope of impact is, and what indicators of compromise (IoCs) exist. The classification and triage here decide the quality of later phases.
• (3) Containment, Eradication & Recovery—stopping the spread (isolate, block), removing the cause (malware, rogue accounts, the vulnerability), and returning operations to a normal state. (4) Post-Incident Activity—reviewing lessons learned and improving detection, procedures, and defenses to prepare for next time. This learning feeds back into (1) Preparation, so the lifecycle turns.

Late at night in the SOC, EDR alerts that a server is emitting periodic beacon traffic to an unfamiliar external IP. You first treat this as the (2) Detection & Analysis phase, examining the destination reputation, the process parent-child relationship, and the host's criticality, and judge it a true positive strongly suggesting C2 (Command and Control) rather than a false positive. Tempting as it is to pull the power in a panic, an abrupt shutdown loses volatile evidence in memory (covered in a later section) and erases eradication clues. With phases in mind, you choose a (3) Containment move that both stops the spread and preserves evidence: "isolate from the network (VLAN separation or blocking the switch port) while keeping the power on to preserve memory." In the following eradication you remove the malware itself and the rogue accounts it created, and in recovery you restore from a clean backup and resume operations under monitoring. Then in the next week's (4) Post-Incident Activity you review "why the first alert did not catch this beacon and it went unseen for hours," and update the detection rules and playbook—which raises the quality of (1) Preparation and speeds detection of the next similar attack. The key here is understanding that even the same action of "isolating a server" is done for the purpose of a specific phase. Mistake the phase and jump to eradication before analysis is done, and you may halt normal business over a false positive; rush to recovery before containment, and you invite reinfection. NIST SP800-61 is the map that keeps you from losing "order and purpose."

5.2.3Section summary

• The IR plan elements = mission, strategies/goals, senior management approval, organizational approach, communication, metrics, maturity roadmap, and fit within the organization; prepare the three layers of policy/plan/procedure (playbook) in advance
• The four NIST SP800-61 phases = preparation -> detection and analysis -> containment/eradication/recovery -> post-incident activity; post-incident lessons feed back into preparation so the lifecycle turns
• The key is mapping an event description to a phase immediately; breaking the analysis -> containment -> eradication -> recovery order invites false-positive shutdowns, lost evidence, and reinfection