Lessons · Cybersecurity · the incident-response phases
The six phases, in order
Incident response runs in a fixed order: prepare, identify, contain, eradicate, recover, and lessons learned.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
At 3 a.m., with a manager on the phone and a server misbehaving, nobody invents a good order. The order is decided in daylight, written down, and followed by whoever is on call, which is why the phases exist at all.
How to think about it
Learn the order as a sentence: get ready, work out what is happening, stop it spreading, remove it, put things back, write down what you would do differently. Each phase has an exit test: you do not move on until it is answered.
Worked example
Prepare: contacts, backups, logs, a written planDone before anything happens. The only phase you can do calmly.
Identify: is this really an incident, and what is affected?Exit test: you can name the systems and the evidence.
Contain: stop it spreading, before you understand it fullyExit test: it is not getting worse.
Eradicate: remove what caused it and close the way inExit test: the cause is gone, not just the symptom.
Recover: restore service and watch it closelyExit test: it is working and staying working.
Lessons learned: what changes, who owns each change, by whenExit test: somebody's name and a date next to every action.
Your turn
You have stopped the malware spreading and now you must remove it. Write the name of that phase.
next phase:
Solve one, graded on the server
The trap
Recovering before eradicating. Restoring the service with the cause still present gives you the same incident again by lunchtime, and a second outage nobody planned for.