Chapter 24 — Incident response
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Phases"]
N2["24.2 The plan"]
N3["24.3 Containment decisions"]
N4["24.4 Exercise"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Phases"]
N2["24.2 The plan"]
N3["24.3 Containment decisions"]
N4["24.4 Exercise"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Phases]
|
v
[24.2 The plan]
|
v
[24.3 Containment decisions]
|
v
[24.4 Exercise]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) describe incident response phases; (2) prepare a response plan; (3) practise response with an exercise.
24.1 Phases
Aisha studies incident response phases: preparation, detection and analysis, containment, eradication, recovery and lessons learned. NIST's Cybersecurity Framework 2.0 groups related outcomes under its Respond and Recover functions. At Ashfield, an incident might be a phishing compromise, ransomware, a lost laptop or a staff member misusing access. Dr. Carrow explains that the phases give structure under pressure, when people otherwise act inconsistently or forget important steps. She writes one Ashfield example for each phase in her journal, which helps her see how a phishing compromise would move through detection, containment, recovery and lessons learned.
24.2 The plan
Aisha drafts an incident response plan for Ashfield. It defines what counts as an incident, who leads the response, how to contact key people out of hours, when to inform the board, regulators, members and the insurer, and where to find technical procedures. She keeps the main plan to four pages with contact details on the first page. Dr. Carrow notes that plans are used under stress, so brevity and clarity matter. The chief executive approves the plan, and a printed copy is kept at every branch.
24.3 Containment decisions
Containment limits damage but can disrupt business. If ransomware is found on a branch computer, disconnecting the branch network stops spread but halts member services there. Aisha writes decision guidance: isolate the affected computer first, then the branch if spread is detected, with the chief executive informed of any branch-level isolation. She learns that agreeing decision rules in advance prevents delay and argument during an incident. She adds a simple flowchart to the plan showing each decision point and who makes it, so the person on duty can follow it quickly even without technical knowledge.
24.4 Exercise
Aisha runs a tabletop exercise with Ashfield's managers. The scenario: a finance officer reports an email from the chief executive asking for an urgent payment to a new supplier. Managers discuss their actions. They realise the plan does not say who decides whether to contact the bank to stop a payment. Aisha adds this to the plan. Dr. Carrow notes that exercises find gaps cheaply, before a real incident does. The managers agree to repeat the exercise every year with a different scenario chosen by the IT manager.
Worked example
Aisha learns response phases, drafts a four-page plan, writes containment decision rules and runs an exercise revealing a missing payment-stop decision.
Synthetic case. Plans and exercises are synthetic.
Errors and limits
An incident plan that is never exercised usually contains gaps.
Exercises
- EX070 — Plan length. How long is the main plan? Rubric: 3 = four pages;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX071 — First containment. What is isolated first for ransomware? Rubric: 3 = the affected computer;; 2 = partly correct;; 1 = branch;; 0 = none.
- EX072 — Exercise gap. What gap did the exercise reveal? Rubric: 3 = who decides to contact the bank to stop a payment;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 24 (chapter 24 of 40)
← Chapter 23 · Course chapter index · Chapter 25 →
Continue to the next authored lesson.