Incident Response and Digital Forensics — SY0-701 Domain 4

Incident response lifecycle

NIST defines six phases for handling security incidents. Security+ tests the order and purpose of each phase.

# NIST SP 800-61 Incident Response lifecycle:

# 1. Preparation
#    - Policies, playbooks, tools, training
#    - Establish IR team (CSIRT) and communication plan

# 2. Detection & Analysis
#    - Identify indicators of compromise (IoCs)
#    - Log analysis, SIEM alerts, threat intelligence feeds
#    - Classify severity (P1 critical → P4 low)

# 3. Containment
#    - Short-term: isolate the affected system (quarantine)
#    - Long-term: patch, change credentials, network segmentation
#    - Goal: stop spread without destroying evidence

# 4. Eradication
#    - Remove malware, backdoors, compromised accounts
#    - Root cause analysis: how did the attacker get in?

# 5. Recovery
#    - Restore from clean backups
#    - Verify systems are clean before reconnecting
#    - Monitor closely for re-infection

# 6. Lessons Learned (Post-Incident Activity)
#    - Document what happened, timeline, response actions
#    - Update playbooks and controls to prevent recurrence

Digital forensics — order of volatility

When collecting evidence, always capture the most volatile data first. Evidence that changes fastest must be captured before you touch anything else.

# Order of volatility (most volatile first):
# 1. CPU registers and cache
# 2. RAM (running processes, open network connections, encryption keys)
# 3. Network state (ARP tables, routing tables, open sockets)
# 4. Running processes (process list, open files)
# 5. Disk (temporary files, swap/pagefile)
# 6. Remote logging and monitoring data
# 7. Physical configuration (network topology)
# 8. Archival media (backups, tapes)

# Key forensics principles:
# Chain of custody: document every person who touches evidence
# Legal hold: preserve data that may be relevant to litigation
# Write blockers: copy a disk without modifying it
# Hash verification: SHA-256 the evidence before and after
#   to prove it was not altered during investigation

Threat intelligence and indicators

Threat intelligence feeds give context about known adversaries and attack patterns. Security+ tests the terminology.

# Indicator types:
# IoC (Indicator of Compromise): evidence a breach occurred
#   - Malicious IP/domain, hash of malware file, registry key
# IoA (Indicator of Attack): evidence an attack is in progress
#   - Unusual process spawning, lateral movement patterns

# Threat intelligence feeds:
# OSINT: open-source (VirusTotal, Shodan, MITRE ATT&CK)
# Commercial: CrowdStrike, Recorded Future, Mandiant
# ISACs: sector-specific sharing (FS-ISAC for finance, H-ISAC for health)

# MITRE ATT&CK Framework:
# Tactics: the adversary's goal (e.g. Initial Access, Persistence, Exfiltration)
# Techniques: how they achieve it (e.g. T1566 Phishing, T1078 Valid Accounts)
# Used for threat hunting, detection engineering, gap analysis

# TTPs (Tactics, Techniques, Procedures):
# The hardest IoCs for attackers to change
# IP addresses are easy to change; TTPs take real effort

Log analysis and SIEM

SIEMs aggregate logs from across the environment to detect threats. Security+ tests the key log sources and what each reveals.

# Key log sources:
# Windows Event Logs:
#   Security log: logon events (4624 success, 4625 fail), privilege use
#   System log: service starts/stops, driver errors
#   Application log: app-level errors

# Linux /var/log/:
#   auth.log / secure: SSH logins, sudo, PAM
#   syslog: general system events
#   apache2/access.log: HTTP requests (source IP, method, status)

# Network logs:
#   Firewall: allowed/denied traffic with 5-tuple
#   DNS: queries (useful for detecting C2 beaconing)
#   NetFlow: traffic metadata without payload

# SIEM capabilities:
# Correlation: link related events across sources
# Baseline: detect anomalies vs normal behaviour
# Alerting: trigger on rule matches (e.g. 5 failed logins in 60s)
# Retention: maintain logs for compliance (often 90 days - 1 year)

# syslog severity levels (0-7):
# 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Info, 7 Debug

Exam tip

Know the 6-phase NIST IR lifecycle cold: Preparation, Detection & Analysis, Containment, Eradication, Recovery, Lessons Learned. Security+ always tests the order (especially that Containment precedes Eradication) and the order of volatility for forensics evidence collection (RAM before disk).

Struggling with Cybersecurity?

Work 1:1 with a vetted Cybersecurity tutor on Wyzant. (affiliate link)