Cybersecurity Roadmap

Learn how to secure networks, applications, and systems against digital threats.

Overall Progress0%

Incident Response

Explanation

Incident response is how an organization handles a security incident: detecting it, containing it, removing the threat, recovering, and learning so it does not happen again. It is a disciplined, evidence-driven process, not a scramble. This lesson teaches the incident response lifecycle, how to classify and contain an incident, how evidence is preserved and analyzed, and how to communicate and learn from the experience. You will work a realistic tabletop exercise and reason through each phase. Everything is hypothetical and defensive. No real systems or credentials are involved.

Incident vs Event

An event is any observable occurrence (a login, a file change).
An incident is an event that causes, or risks, harm to confidentiality, integrity, or availability.
Not every alert is an incident; classification matters.

The Incident Response Lifecycle

Preparation

↓

Detection & Analysis

↓

Containment

↓

Eradication

↓

Recovery

↓

Lessons Learned

The lifecycle is a loop: lessons learned feeds back into preparation, making the next response faster and stronger.

Preparation

Define roles, contacts, and escalation paths before an incident.
Build playbooks for common incident types.
Ensure logging, tooling, and evidence-handling are ready.

Detection and Analysis

Confirm the incident is real (avoid false positives).
Determine scope: which systems, accounts, and data are affected.
Build a timeline from correlated evidence.

Containment Strategies

Strategy	Goal	Example
Short-term	Stop the bleeding now	Isolate a host, revoke a session
Long-term	Contain while preserving evidence	Segment the network, keep a copy for forensics

Containment balances speed against preserving evidence: stop the harm without destroying what you need to investigate.

Eradication

Remove the root cause: the malware, the backdoor, the misconfiguration.
Confirm persistence mechanisms are gone.
Apply the fix that prevents recurrence.

Recovery and Validation

Restore systems from trusted backups.
Validate that systems are clean and functioning before returning to service.
Monitor closely after recovery for signs the threat returned.

Lessons Learned / Post-Incident Review

Review what happened, what worked, and what did not.
Document root cause and missing controls.
Turn findings into new detections, policies, and playbooks.

Incident Classification and Severity

Severity	Example
Low	Minor policy violation
Medium	Single-user account compromise
High	Lateral movement or data exposure
Critical	Ransomware, mass data exfiltration

The Incident Commander

One person coordinates the response and decisions.
They track tasks, timelines, and communication.
Clear command prevents chaos during a crisis.

Evidence Preservation and Chain of Custody

Preserve evidence in its original state.
Chain of custody records who handled evidence, when, and why.
Proper handling keeps evidence admissible and trustworthy.

Volatile vs Non-Volatile Evidence

	Volatile	Non-volatile
Examples	Memory, network state, running processes	Disk, logs, backups
Lifetime	Lost on power-off	Persists
Collection order	Collect first	Collect after volatile

Forensics: Memory, Disk, and Network

Memory forensics: recover running processes, injected code, and encryption keys.
Disk forensics: recover deleted files and artifacts.
Network forensics: reconstruct sessions from captured traffic.

Timeline and Root Cause Analysis

Correlate events into a single timeline.
Root cause analysis finds the true origin, not just symptoms.
The timeline answers what happened, when, and in what order.

Communication and Stakeholder Management

Communicate clearly and on schedule to leadership and affected teams.
Separate technical detail from business impact.
Legal and compliance may require specific notifications.

Playbooks and Tabletop Exercises

Playbooks give step-by-step guidance per incident type.
Tabletop exercises rehearse the response without a real incident.
Rehearsal exposes gaps in plans before a real crisis.

Examples

A tabletop exercise scenario

A suspicious account, described for analysis.

text

1Indicators:2  - login from two countries 15 minutes apart3  - a new MFA device registered4  - unusual cloud storage access5  - a large data transfer to an external service

Output

(classify, contain, investigate, recover, learn)

Containment decision

Weighing speed against evidence preservation.

text

1Fast: disable the account, revoke sessions, block the IP2Then: snapshot the affected systems before cleanup3Then: investigate the timeline and root cause

Output

(stop the harm first, then preserve and investigate)

Key Takeaways

Incident response follows a lifecycle: prepare, detect, contain, eradicate, recover, learn.
Containment balances speed against evidence preservation.
Collect volatile evidence before non-volatile.
Preserve evidence and maintain a chain of custody.
Root cause analysis and lessons learned prevent recurrence.
Rehearse with tabletop exercises so the real response is not improvised.

← PreviousSOC Operations