The IR Lifecycle: Prepare, Identify, Contain

Incident Response (IR) is the organized approach to addressing and managing security incidents. The goal is to minimize damage, reduce recovery time, and prevent recurrence. Having a documented IR plan before an incident is critical.

Major IR frameworks:

• NIST SP 800-61: Preparation → Detection/Analysis → Containment/Eradication/Recovery → Post-Incident
• SANS PICERL: Prepare, Identify, Contain, Eradicate, Recover, Lessons Learned
• CISA: Broadly aligned with NIST

Preparation activities:

• Document IR policy and procedures
• Build and train the IR team (CIRT)
• Deploy logging and detection tools
• Establish communication channels and escalation paths
• Conduct tabletop exercises and simulations
• Create runbooks for common incident types

Prepare before incidents occur:

• Centralized SIEM for log analysis
• Forensic workstation with write blockers and imaging tools
• Legal and HR contacts pre-identified
• IR retainer with external forensics firm
• Offline backups verified and accessible

Identification is detecting and confirming that an incident has occurred. Sources of detection:

• SIEM alerts and IDS/IPS events
• User reports ("my computer is acting strange")
• Threat intelligence feeds
• Anomaly detection (unusual login times, data transfers)
• Third-party notification (law enforcement, partners)

Classify incidents by severity to prioritize response:

• P1/Critical: active breach, data exfiltration, ransomware
• P2/High: compromised privileged account, malware detected
• P3/Medium: policy violation, suspicious activity
• P4/Low: failed login attempts, minor misconfiguration

Containment stops the spread of damage without destroying evidence. Two types:

• Short-term containment: isolate affected systems (network quarantine)
• Long-term containment: remove malicious artifacts while maintaining operations

Containment actions:

• Network isolation: VLAN quarantine, firewall block rules
• Account lockout: disable compromised credentials
• EDR kill: terminate malicious processes via EDR
• DNS sinkhole: redirect C2 domains to prevent callbacks
• Preserve evidence BEFORE wiping

During major incidents, use a clear command structure:

• Incident Commander — overall coordination
• Technical Lead — investigation and remediation
• Communications Lead — internal and external notifications
• Legal/Compliance — regulatory obligations

Effective IR runs containment, investigation, and communications in parallel — not sequentially. While the technical team contains the threat, legal prepares notifications and management communicates with stakeholders. Time matters: every hour of uncontained access causes more damage.

Document everything during an incident:

• Timeline of events with timestamps
• All actions taken (with who, what, when)
• Evidence collected and chain of custody
• Decisions made and rationale

This documentation is essential for legal proceedings and the post-incident review.

During which IR phase would you isolate an infected system from the network to stop malware from spreading?

The IR lifecycle (NIST): Preparation, Identification, Containment, Eradication, Recovery, Post-Incident. Preparation is the most important phase — build the team, tools, and runbooks before incidents happen. Identification confirms an incident. Containment stops spread while preserving evidence. Document every action with timestamps.