Security Incident Response

How security incidents differ from reliability incidents. The NIST framework, forensics, legal obligations.

Overview

Incident command with an adversary

Security incident response shares the incident-command structure of reliability incidents, with three critical differences: an active adversary, legal and regulatory obligations, and the need for forensics.

The NIST framework, SP 800-61, defines four phases.

> [!IMPORTANT] Do not alert the attacker. An adversary who knows they are detected may cover tracks, escalate or pivot.

Phase 1: preparation

Plan — Documented incident response plan
Roles — Security Lead, Comms, Legal liaison, IT
Contacts — Legal, PR, executives, vendor support, law enforcement liaison
Forensic tooling — Disk imaging, memory capture, log retention, staged in advance
Practice — Game days simulating common incidents
Runbooks — Per type: data breach, malware, account compromise, DDoS

Phase 2: detection and analysis

Security tools — SIEM alerts, EDR, IDS/IPS
External notification — Customer reports, researcher disclosure, law enforcement contact, public news
Internal anomalies — Unusual access, unexpected resource creation, audit log discrepancies
Threat intelligence — Industry alerts, vendor advisories

Analysis confirms the incident is real, scopes affected systems and start time, rates severity by data sensitivity and business impact, and asks who the adversary is: a known threat actor or an insider.

Phase 3: contain, eradicate, recover

3a. Containment — Block source IPs and isolate compromised hosts; disable compromised accounts and force password resets; take vulnerable services offline temporarily; segment the network against lateral movement
3b. Eradication — Find every backdoor and persistence mechanism (scheduled tasks, services, created accounts); remove compromised binaries; patch the entry vulnerability; reset possibly compromised credentials; reimage hosts where possible
3c. Recovery — Bring services back; monitor heavily for re-compromise; validate data integrity; communicate with affected users

Cover tracks — Delete logs and evidence
Escalate — Deploy ransomware before being kicked out
Pivot — Move to harder-to-detect persistence

The investigation often runs silently for hours or days. Eradication is rigorous because one missed persistence mechanism brings the attacker back, and it often takes days to weeks.

Phase 4: post-incident

Timeline — Detailed
Root cause analysis — How they got in and why it was not caught
Action items — Patches, controls, detection improvements
Disclosure — CVE, customer notification, regulatory filing
Forensic report — Often protected by legal privilege

Key differences from reliability incidents

1. Adversary — Actively responds to your detection and may escalate; do not reveal your capabilities
2. Legal and regulatory — Breach notification: GDPR 72 hours, HIPAA varies, US state laws typically 30-60 days; law enforcement involvement sometimes mandatory; customer, partner and regulator notices
3. Forensics — Chain of custody; image disks before cleanup; capture memory, which is lost on restart; preserve logs for possible proceedings
4. Public disclosure — Coordinated timing so patches can deploy; CVE assignment; press management
5. Insurance and counsel — Cyber insurance often mandates procedures; counsel involved early to preserve attorney-client privilege

The SRE's role

> [!TIP] Do not lead the response unless you are also the security lead. Strategy needs security expertise.

The 2026 trends

AI-assisted response — Anomaly correlation, log analysis
Threat-intel-driven detection — Known TTPs from MITRE ATT&CK
Cloud-native forensics — Preserved snapshots, immutable logs
Regulatory scrutiny — SEC disclosure rules, EU NIS2 directive

Key concepts

NIST SP 800-61 framework: Four phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident.
Containment: Stop the attack from spreading. Don't alert the attacker if possible. Network isolation, account disabling.
Eradication: Remove all attacker presence. All backdoors, all credentials, all persistence mechanisms.
Forensics + chain of custody: Preserve evidence. Disk imaging, memory capture, log retention. May be legal evidence.
Breach notification: GDPR 72h, HIPAA varies, state laws 30-60d. Mandatory; missing them = legal exposure.
Don't alert the attacker: Premature disclosure may cause attacker to escalate (ransomware) or cover tracks. Silent investigation often required.

When to use it

Security incident detected — apply NIST framework
Designing incident-response capabilities — what runbooks needed?
Security tooling investment — SIEM, EDR, forensics tooling
Compliance prep — incident-response plan often required

Interview questions

How do you respond to a credential compromise alert?
What's the difference between a security incident and a breach?
How do you prepare for a major security incident before one happens?