NIST SP 800-61r2 lifecycle, practically
1. Preparation (before the incident):
- Written IR plan + playbooks for your top 5 scenarios (ransomware, BEC, lost device, web defacement, insider data theft)
- Call tree: who decides, who talks to management/legal/PR, who talks to PKCERT/NCCIA
- Jump kit: clean laptop, external drives, forensic tools, spare MFA
- Baselines: you can't spot abnormal without normal
2. Detection & Analysis: triage (see SOC course) → declare incident → assign severity (SEV1 = business down/data exfil; SEV4 = policy violation) → start the incident log (timestamped actions — this becomes the legal record).
3. Containment → Eradication → Recovery:
- Contain: isolate (network-cut, not power-off — preserve RAM), block IOCs at perimeter, disable compromised accounts, revoke sessions/tokens.
- Eradicate: reimage, rotate ALL credentials touched by the compromised system, patch the entry vector, remove persistence (tasks/services/registry/run keys/mailbox rules).
- Recover: restore from CLEAN backups (verify backup integrity — ransomware hunts them first), staged return, heightened monitoring for 2 weeks.
4. Post-Incident: lessons-learned within 5 working days, playbook updates, detection gaps → new SIEM rules, report to PKCERT per national policy.
The 3 backups commandments: 3 copies, 2 media, 1 OFFLINE/immutable. Test restores quarterly — an untested backup is a rumor.