Chapter 22 — Incident handling
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 The procedure"]
N2["22.2 A real incident"]
N3["22.3 Evidence"]
N4["22.4 Communication"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 The procedure"]
N2["22.2 A real incident"]
N3["22.3 Evidence"]
N4["22.4 Communication"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 The procedure]
|
v
[22.2 A real incident]
|
v
[22.3 Evidence]
|
v
[22.4 Communication]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) follow an incident procedure; (2) preserve evidence; (3) communicate during and after an incident.
22.1 The procedure
Riverbend has a short incident procedure written by the IT manager with Jamal's help: report, assess, contain, investigate, recover and review. It is based on the Respond and Recover functions of the NIST Cybersecurity Framework 2.0. Each step names who acts and how to contact them out of hours. Ms. Grant explains that technologists are often first on the scene, so they must know the procedure well enough to follow it calmly under pressure. Jamal keeps a printed copy in his bag during centre visits.
22.2 A real incident
A centre manager reports that her email account sent messages she did not write. Jamal follows the procedure. He resets her password, signs out all sessions, checks for forwarding rules and finds one sending copies of her mail to an external address. He removes it and confirms multi-factor authentication is enabled. The account had been one of the last waiting for enrolment. He records every step with times in the incident log. He also checks the sent folder to see which recipients received the messages, so they can be warned.
22.3 Evidence
Before removing the forwarding rule, Jamal takes a screenshot and exports the sign-in logs showing a login from an unfamiliar country. He stores them in a restricted folder with the date and his name. Ms. Grant explains that evidence collected carefully helps understand what happened and may be needed by insurers or regulators. Changing things before recording them can destroy the evidence needed to know what the attacker accessed. He records the time zone of each log entry, because the sign-in logs use universal time while the centre manager reported local times.
22.4 Communication
The IT manager tells the centre manager what happened and what was done, informs the data protection lead because member emails were forwarded, and warns other staff about the phishing message used. A short review afterwards identifies the cause: delayed enrolment in multi-factor authentication. The remaining enrolments are completed within a week. Jamal learns that clear communication reduces worry and that reviews turn incidents into improvements. The data protection lead reviews which member emails were forwarded and decides, with the IT manager, how to inform the affected members. Jamal adds the incident and its lessons to the monthly report.
Worked example
Jamal follows the procedure for a compromised mailbox, removes an external forwarding rule after capturing evidence, involves the data protection lead and helps close the enrolment gap.
Synthetic case. The incident is synthetic.
Errors and limits
Changing settings before recording them can destroy evidence.
Exercises
- EX064 — Procedure basis. Which CSF 2.0 functions shape the procedure? Rubric: 3 = Respond and Recover;; 2 = partly correct;; 1 = other;; 0 = none.
- EX065 — Forwarding rule. What did Jamal find in the mailbox? Rubric: 3 = a rule forwarding mail externally;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX066 — Root cause. What caused the incident? Rubric: 3 = delayed MFA enrolment;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 22 (chapter 22 of 30)
← Chapter 21 · Course chapter index · Chapter 23 →
Continue to the next authored lesson.