Security · Incident Response
Incident Response
The prepared, repeatable process for detecting, containing, eradicating and recovering from security incidents, and learning from them.
Overview
Incident response is an operational discipline with a defined lifecycle, roles and decision authority. NIST SP 800-61 organises it as preparation, detection and analysis, containment/eradication/recovery, and post incident activity.
Most response failures are not technical. They are missing authority to disconnect systems, unclear escalation, no out of band communications, unavailable contact lists, or backups that were never tested.
How it works
- 01Severity classification drives who is engaged and how quickly, and should be written down before an incident, not negotiated during one.
- 02Scoping precedes eradication: containing one host while the attacker holds valid credentials or a token achieves little.
- 03Identity containment is now central, revoke sessions and refresh tokens, reset credentials, review MFA registrations and OAuth grants.
- 04Recovery requires a defined clean state, verified backups, and monitoring for re entry during and after restoration.
Sequence
- 1Preparation
- 2Detection
- 3Analysis & scoping
- 4Containment
- 5Eradication
- 6Recovery
- 7Lessons learned
Layer model
Design considerations
- Maintain a printed or offline copy of the plan, contacts and network diagrams; assume email and file shares are unavailable.
- Agree in advance who can authorise disconnecting a business critical system.
- Define evidence handling and chain of custody expectations with legal and insurers.
- Exercise at least annually, including an executive decision making scenario.
Security considerations
- Protect the response effort itself: use a separate, trusted communication channel and privileged workstations.
- Do not tip off the adversary with premature, partial remediation.
- Capture volatile evidence (memory, sessions, logs) before rebuilding.
Common misconfigurations
- Backups reachable with production domain credentials, so they are encrypted with everything else.
- Log retention shorter than typical dwell time, making scoping impossible.
- Plan written for a data breach only, with no ransomware or SaaS compromise scenario.
IT vs OT
OT incident response prioritises safe process state and often cannot isolate a controller. Response authority usually sits with operations and engineering rather than IT security. See OT Atlas.
IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.