5.4Incident Response in Practice

Modern security management prepares on the premise that the question is not "whether" an incident will occur but "when." When an incident actually happens, whether you know the procedure makes an entirely different difference to how fast the damage spreads and how well accountability is met afterward. Exam B centers on questions that ask "what should be done right now, at this point" within the flow from detection through post-incident activity.

5.4.1The flow from detection to recovery

• Detection is the stage of grasping an anomaly through log monitoring, IDS/IPS alerts, or reports from employees. Initial response is the stage, immediately after detection, of provisionally grasping the scope of damage and immediately reporting to the person in charge. A misjudgment here puts the later containment step behind the curve. Containment is the stage of taking action to stop the damage from spreading further than it already has, such as isolating an infected endpoint from the network or temporarily suspending the affected account.
• Eradication is the stage, after containment, of removing the root of the problem--for example, removing the malware that caused the incident or fixing the vulnerability that was exploited. Recovery is the stage of restoring from backup and resuming service, once eradication has been confirmed. If recovery is rushed and the system is returned to its original state before eradication is thorough, the risk of re-entry through the same route remains. Not skipping the order of these six stages--detection, initial response, containment, eradication, recovery, post-incident activity--is the basic discipline of the practice.