CompTIA Security Plus – Section 24: Incident Response Study Guide

Section 24: Incident Response Study Guide

1. Scope and Importance of Incident Response (IR)

Definition: Incident Response is the organized approach to detect, analyze, contain, eradicate, and recover from security incidents (breaches, malware outbreaks, insider threats, etc.).

Why It Matters: Timely and effective IR minimizes damage, reduces downtime/cost, preserves evidence, and informs stronger future defenses.

Security+ Emphasis: Understand IR lifecycle phases, roles/responsibilities, documentation and communication, tools and techniques, and post-incident lessons learned.

2. Incident Response Phases

CompTIA Security+ aligns with industry-standard IR models (e.g., NIST SP 800-61). The phases are:

2.1 Preparation

• Goal: Establish policies, procedures, communication plans, IR team roles, tools inventory, and training before an incident occurs.
• Key Elements:
  • IR Policy & Plan: Written procedures for detection, escalation, roles/responsibilities, legal considerations.
  • Team Formation: Define IR team (incident handler, forensic analyst, legal liaison, management liaison, communications).
  • Tools & Infrastructure: Ensure availability and readiness of necessary tools (SIEM, forensic imaging tools, sandbox environment, secure logging).
  • Training & Exercises: Conduct tabletop exercises, simulations, phishing drills, and update playbooks based on evolving threats.
  • Communication Plan: Predefine who to notify (internal—legal, management, IT teams; external—law enforcement, partners, customers) and how.
  • Legal & Regulatory: Know data privacy laws, breach notification requirements (GDPR, HIPAA), chain-of-custody requirements.

2.2 Identification (Detection & Analysis)

• Goal: Determine whether an anomaly is an incident, scope/severity, and initial triage.
• Key Elements:
  • Detection Sources: IDS/IPS alerts, SIEM correlations, antivirus/EDR alerts, user reports, log anomalies, network traffic anomalies.
  • Triage Criteria: Validate alert legitimacy (false positive vs. true incident), classify incident type (malware, DDoS, data exfiltration, insider misuse).
  • Initial Analysis:
    • Review logs (system, application, network).
    • Gather indicators of compromise (IOCs): malicious IPs, file hashes, unusual account activity.
    • Determine affected assets and potential impact.
  • Documentation: Record timeline, evidence sources, initial findings in an IR ticket or secure log.

2.3 Containment

• Goal: Limit the incident’s spread or further damage while preserving evidence.
• Strategies:
  • Short-term (Immediate) Containment:
    • Isolate affected systems (network segmentation, VLAN changes, disconnect from network).
    • Block malicious IPs or domains at firewall/IDS/IPS.
    • Disable compromised accounts or reset credentials.
    • For ransomware: isolate infected endpoints from shared drives.
  • Long-term (Strategic) Containment:
    • Deploy temporary fixes or compensating controls (e.g., patch vulnerable services in a test environment before full rollout).
    • Create “clean” environments (e.g., rebuild affected servers on patched images).
  • Evidence Preservation:
    • Avoid actions that overwrite volatile data unless documented.
    • Collect memory dumps, disk images, log snapshots before remediation steps when feasible.
  • Communication:
    • Notify stakeholders of containment actions.
    • Coordinate with operations to avoid unintended business disruption.

2.4 Eradication

• Goal: Remove root cause and all traces of the threat from environment.
• Key Steps:
  • Root Cause Analysis: Identify vulnerability or misconfiguration exploited.
  • Remove Malware/Backdoors: Use antivirus/EDR to clean or rebuild infected hosts from trusted images.
  • Patch and Harden: Apply missing patches, update configurations, strengthen controls.
  • Credential Reset: Rotate credentials, revoke compromised certificates or tokens.
  • Verify Removal: Re-scan systems, review logs for recurrence indicators.

2.5 Recovery

• Goal: Restore systems to normal operations while ensuring no residual threats remain.
• Activities:
  • System Restoration: Rebuild or restore from clean backups; verify integrity before reconnecting to production.
  • Monitoring: Intensify monitoring of restored systems for any signs of re-infection or suspicious activity.
  • Functional Testing: Ensure applications/services work correctly and securely post-restoration.
  • Gradual Reintroduction: Return systems into production in phases, verifying stability and security at each step.
  • User Communication: Inform stakeholders/users when services are back online and any required actions.

2.6 Lessons Learned (Post-Incident Activity)

• Goal: Analyze the incident and response to improve future readiness.
• Key Elements:
  • Post-Mortem Report: Document timeline, root cause, containment/eradication steps, impact analysis, cost/time metrics.
  • Root Cause Mitigation: Implement permanent fixes or process changes.
  • Update IR Plan & Playbooks: Incorporate lessons (detection gaps, communication bottlenecks, tool limitations).
  • Training & Awareness: Share sanitized lessons; adjust training programs.
  • Metrics & KPIs: Track “time to detect,” “time to contain,” and “time to recover” to measure improvement.

3. Roles & Responsibilities

Incident Response Team (IRT): Cross-functional group:

• Incident Manager/Coordinator: Oversees IR activities, communication, resource allocation.
• Technical Analysts/Forensic Specialists: Conduct detection, analysis, containment, and forensic evidence collection.
• Network/System Administrators: Implement containment/eradication controls, restore systems.
• Legal/Compliance Liaison: Advises on legal/regulatory considerations, breach notifications.
• Communications/PR: Manages messaging to internal/external audiences.
• Management Stakeholders: Provide authority for actions impacting business operations.

Escalation Paths: Predefine when to escalate to senior management, legal teams, or external parties.

4. Tools & Techniques

4.1 Detection & Monitoring

• SIEM: Aggregate and correlate logs, trigger alerts on suspicious patterns.
• EDR/Endpoint Agents: Monitor processes, file changes, behavioral anomalies; support rapid isolation.
• Network IDS/IPS: Detect malicious traffic signatures or anomalies.
• Log Analysis Tools: Centralized log collectors, search utilities.

4.2 Forensic Data Collection

• Memory Acquisition Tools: Obtain volatile memory (e.g., winpmem, LiME).
• Disk Imaging Tools: Create forensically sound copies (e.g., FTK Imager, dd with hash verification).
• Network Traffic Capture: Packet capture appliances or mirrored ports; Wireshark or Zeek.

4.3 Analysis & Investigation

• Forensic Frameworks: Volatility, Autopsy/Sleuth Kit, timeline creation.
• Malware Analysis Environments: Sandboxed VMs, dynamic/static analysis tools.
• Threat Intelligence: Enrich IOCs with threat feeds.
• Log/Packet Analysis: Search for anomalies and lateral-movement indicators.

4.4 Containment & Eradication

• Network Controls: Firewalls, NAC, VLAN reconfiguration, blacklists.
• Endpoint Controls: EDR isolation, disabling accounts, revoking credentials.
• Patching & Hardening Tools: Vulnerability scanners, configuration management tools.
• Backup & Restore: Verified backups; recovery procedures.

4.5 Communication & Documentation

• Ticketing Systems: Record all IR steps, evidence collected.
• Playbooks & Runbooks: Procedures for common incident types.
• Reporting Tools: Templates for internal and regulatory reports.

4.6 Post-Incident

• Metrics Tools: Dashboards/logs to measure performance (MTTD, MTTC, MTTR).
• Knowledge Base: Update with IOCs, detection signatures, lessons learned.

5. Best Practices & Forward-Thinking Considerations

• Automation & Orchestration: Leverage SOAR with oversight.
• Threat Hunting: Proactively search for hidden threats.
• Zero Trust Mindset: Design IR assuming potential compromise.
• Cloud & Hybrid Environments: Adapt IR plans for cloud contexts, coordinate with providers.
• Supply Chain Risks: Include third-party systems in planning; define breach-notification obligations.
• Legal & Privacy by Design: Minimize sensitive data collection; understand cross-border restrictions.
• Continuous Improvement: Regularly update IR plan, playbooks, and tools based on exercises and incidents.
• Resilience & Business Continuity: Coordinate IR with BCP/DR for critical operations.
• Metrics & Reporting: Define KPIs (MTTD, MTTC, MTTR) to demonstrate IR effectiveness.

6. Common Pitfalls & How to Avoid Them

• Lack of Preparation: No IR plan or training leads to chaos. Avoid by maintaining/exercising IR plan.
• Over-Isolation: Disconnecting critical systems without assessing impact. Avoid by balancing containment with business continuity.
• Insufficient Evidence Preservation: Remediating before collecting volatile data. Avoid by capturing memory/disk first.
• Poor Communication: Failing to inform stakeholders or oversharing. Avoid by following communication plan and legal guidance.
• Ignoring Post-Incident Analysis: Restoring systems without updating controls. Avoid by conducting lessons-learned sessions.
• Outdated Tools: Using obsolete tools misses threats. Avoid by regularly updating toolset and integrating threat intelligence.
• Underestimating Cloud Complexities: Applying on-prem IR directly to cloud. Avoid by understanding cloud logging and shared-responsibility.

7. Sample Security+–Style Scenarios

Practice mapping scenario → IR phase → tools/actions → Security+ objective:

7.1 Scenario A: Unusual Outbound Traffic

• Identification: SIEM alert flags large data transfer; confirm via logs.
• Containment: Block IP; isolate server.
• Eradication: Image memory/disk; analyze and remove malware; patch vulnerability.
• Recovery: Restore from backup; monitor for recurrence.
• Lessons Learned: Identify compromise vector; update detection rules and IR playbook.
• Objective: 4.1, 4.4/4.5, 4.6.

7.2 Scenario B: Ransomware Alert

• Identification: EDR alert indicates encryption activity.
• Containment: Isolate endpoint; disable accounts.
• Eradication: Preserve image; remove malware; restore files.
• Recovery: Verify backups; rebuild endpoint; educate user.
• Lessons Learned: Improve backups, email filtering, EDR rules.
• Objective: 4.1, 4.4/4.5, 4.6.

7.3 Scenario C: Phishing Campaign

• Identification: Analyze phishing emails for IOCs.
• Containment: Block domains; notify users; reset credentials.
• Eradication: Remove emails; update filters; patch vulnerabilities.
• Recovery: Monitor credential misuse; ensure no lateral movement.
• Lessons Learned: Enhance training; adjust filters; update playbook.
• Objective: 4.1, 4.4/4.5, 4.6.

7.4 Scenario D: DDoS Attack

• Identification: Traffic analytics reveal high-volume requests.
• Containment: Engage mitigation service; use CDN or scrubbing.
• Eradication: Mitigate via filtering; protect origin servers.
• Recovery: Restore normal routing; monitor for follow-up.
• Lessons Learned: Plan capacity; implement scalable mitigation; update IR plan.
• Objective: 4.1, 4.6.

8. Exam Focus Points

• Phases & Terminology: List and describe IR phases and activities.
• Roles & Communication: Understand team roles and communication plans.
• Tool Selection: Map scenario to IR tools (e.g., memory acquisition).
• Containment Strategies: Differentiate immediate vs. strategic containment; business impact.
• Forensics Basics: Know when to collect memory vs. disk; preserve evidence; chain-of-custody.
• Legal & Regulatory: Breach-notification requirements; privacy considerations.
• Cloud IR Considerations: Differences in evidence collection in cloud; shared-responsibility.
• Metrics & Improvement: MTTD, MTTC, MTTR; importance of lessons-learned.
• Common Pitfalls: Avoid premature remediation, over-isolation without buy-in.

9. Dry Reality Check

“An organization without practiced IR processes wastes precious time during an incident. Knowing every tool name is insufficient; you must know how to prepare, detect accurately, weigh containment vs. business impact, preserve evidence properly, and then drive continuous improvement.”

10. In Summary

• Memorize IR lifecycle phases and typical activities/tools in each.
• Understand roles, communication flows, legal/regulatory constraints.
• Practice scenario mapping: scenario → detect → containment → forensic collection → eradication → recovery → lessons learned.
• Focus on automation, threat hunting, cloud nuances, and metrics.
• Validate knowledge by explaining rationale for actions in each phase, not just naming tools.