2.4Incident Management and CSIRT

No matter how thoroughly preventive controls are prepared, the occurrence of an incident (a security event) cannot be completely prevented. What matters is having a structure ready in advance, premised on the assumption an incident will occur, to minimize damage, pinpoint the cause, and prevent recurrence. This section covers the standard flow of incident response, the CSIRT organization that carries it out, and digital forensics, the foundation of damage investigation.

2.4.1The incident response process

• Detection/reporting is the stage of recognizing a suspected incident, whether through monitoring-system alerts or reports from employees. Triage is the stage of evaluating the severity and scope of impact of the detected event and judging response priority. Treating every report the same would exhaust limited staff, so prioritization is essential.
• Containment is the stage of stopping damage from spreading further (for example, disconnecting an infected endpoint from the network). Eradication is the stage of removing the cause (malware, the intrusion route of unauthorized access, and so on). Recovery is the stage of returning operations to normal. Getting the order wrong--recovering before eradication--leaves the risk of recurrence from the same cause.
• Post-incident activity (lessons learned) is the stage, after the response has settled, of feeding the results of root-cause analysis into recurrence-prevention measures and reviewing the response process itself. Skipping this stage means similar incidents recur, or the next response repeats the same confusion.

2.4.2The difference in roles between CSIRT and SOC

• A CSIRT (Computer Security Incident Response Team) is the team that acts as the command center for response when an incident occurs, directing triage, containment, eradication, and recovery after detection, and serving as the coordination point with related departments, management, and outside parties. A SOC (Security Operation Center) is an organization specialized in the role of monitoring logs and alerts around the clock to detect anomalies.
• The general division of roles is that the SOC handles monitoring/detection and escalates detected events to the CSIRT, which then directs the response (in some organizations, a single team performs both functions). It is important to distinguish the role of "monitoring and finding" from the role of "directing what happens once something is found."

2.4.3Evidence preservation, digital forensics, and external organizations

• Evidence preservation is the activity of saving the logs, disk images, and so on of an affected device in a form that can withstand later investigation or legal proceedings. Directly manipulating the original compromises its integrity as evidence, so the principle is to take a copy (an image) and perform analysis on that copy.
• Digital forensics is the activity of analyzing preserved evidence (logs, memory, disks, and so on) to scientifically uncover the intrusion route, scope of damage, and traces left by the attacker. It is used as the basis for eradication/recovery decisions and for external explanations and legal response. Unless evidence preservation is carried out in parallel from the earliest stage of the response, important evidence risks being lost--for example, through re-imaging a device as part of containment.
• JPCERT/CC is a cross-organizational, neutral body (not affiliated with a specific company) that coordinates incident response and provides information domestically. It handles cross-organizational sharing of incident information and coordination of vulnerability information. JVN (Japan Vulnerability Notes) is a portal site for vulnerability countermeasure information, jointly operated by JPCERT/CC and IPA. It serves as a primary source when checking vulnerability information about products an organization uses.

Follow a sequence of response actions through an example where an employee's device at a company is suspected of being infected with malware, and a report reaches the information systems department. First, suspicious outbound communication recorded in logs the SOC was monitoring coincides with an employee report of "suspicious behavior," entering the detection stage. The SOC escalates this event to the CSIRT, which performs triage and judges it "a device close to the business system handling customer information, with potentially large scope of impact," positioning it as a top-priority case. Next, as containment, the device is immediately disconnected from the network, stopping damage from spreading further (infection of other devices, or continued transmission of information outward). What matters here is that, in parallel with the disconnection, the device's disk image and memory state are copied and saved as evidence preservation. If this preservation were deferred and the device re-imaged first, the clues needed to identify the intrusion route would be lost. Using the preserved evidence, digital forensics is performed, revealing that opening a specific attachment led to malware infection and that an external attacker had gained remote access, leaving traces. Based on this analysis, in the eradication stage the malware is completely removed, and the vulnerability exploited via the identified intrusion route (the attachment file format in question) is checked against JVN for countermeasure information, and the necessary patch is applied. After confirming the cause has been removed, as recovery the device is reconnected to the network and returned to normal business use. Finally, as post-incident activity, the reason the employee opened the suspicious attachment is analyzed, and recurrence-prevention measures--strengthening targeted-attack-email drills, introducing automatic attachment scanning--are planned. Depending on the scope of impact, an explanation to customers may also be needed, in which case the objective facts obtained through digital forensics become the basis for that explanation. Understanding that SOC monitoring, CSIRT direction, evidence preservation and forensics, and the use of external vulnerability information (JVN) all connect as a single continuous flow matters in practice.

2.4.4Section summary

• Incident response proceeds as detection/reporting -> triage -> containment (stop the spread) -> eradication (remove the cause) -> recovery (return to normal) -> post-incident activity
• SOC specializes in round-the-clock monitoring/detection; CSIRT is the command center for directing/coordinating response. Distinguish the two roles
• Evidence preservation analyzes a copy without altering the original, carried out in parallel from an early stage. Digital forensics scientifically uncovers the cause. JPCERT/CC is the coordinating body; JVN is the vulnerability information portal