An incident is an event that threatens the confidentiality, integrity or availability of systems or data. Having a rehearsed plan turns panic into process.
Events, alerts and incidents
An event is anything observable. An alert is an event flagged for review. An incident is a confirmed event with real or likely harm. Not every alert is an incident, which is why triage matters.
The NIST lifecycle
NIST describes four main phases (often taught as six steps):
- Preparation: build the plan, define roles, create contact lists, deploy logging and tools, train staff and run tabletop exercises. Most success is decided here.
- Detection and analysis: spot indicators (unusual logins, antivirus alerts, user reports), confirm the incident, scope what is affected, and rate severity and priority. Document everything with timestamps.
- Containment, eradication and recovery:
- Containment: stop the spread. Short term: isolate the host from the network, disable an account. Long term: temporary fixes while you prepare a clean rebuild.
- Eradication: remove the root cause, such as malware, backdoor accounts or the exploited vulnerability.
- Recovery: restore from clean backups, monitor closely, return to service.
- Post-incident activity (lessons learned): hold a blameless review soon after, update procedures, and track metrics like time to detect and time to recover.
The SANS model lists these as Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.
Roles and communication
A typical team includes an incident commander, analysts, IT operations, legal, communications and management. Decide in advance who may declare an incident, who speaks to the public and when law enforcement or regulators must be told. Use an out-of-band channel if the normal one may be compromised.
A short scenario
An analyst sees an employee laptop contacting an unknown server at 3 a.m. Detection confirms malware. The team isolates the laptop, resets the user’s credentials, searches for the same indicators on other machines, removes the malware, restores the laptop from a clean image, and then reviews why the phishing email got through.
Common mistakes
- Powering off a machine too early and losing memory evidence.
- Wiping systems before preserving evidence.
- No tested backups.
- Skipping the lessons-learned review.
Check your understanding
1. Which phase includes writing the plan and training the team?
- Containment
- Preparation
- Recovery
- Eradication
Answer: Preparation. It happens before any incident occurs.
2. Isolating an infected host from the network is part of:
- Containment
- Preparation
- Lessons learned
- Detection
Answer: Containment. It stops the incident from spreading.
3. What is eradication?
- Detecting an alert
- Removing the root cause such as malware or a backdoor
- Writing a press release
- Buying insurance
Answer: Removing the root cause such as malware or a backdoor. This prevents reinfection.
4. Why hold a lessons-learned review?
- To assign blame
- To improve defenses and the response plan
- To delete logs
- To end monitoring
Answer: To improve defenses and the response plan. Each incident is a chance to get stronger.