4.3 Executing the Incident Response Lifecycle (NIST SP 800-61r2)

🎯 Key CompTIA Security+ Exam Takeaways

• The NIST SP 800-61r2 lifecycle includes Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity.
• Preparation establishes incident response policies, forms the CSIRT team, deploys monitoring tooling, and trains personnel prior to breaches.
• Containment stops active incident spread (e.g., logical network isolation) while preserving volatile forensic evidence in system memory.
• Eradication removes all malicious artifacts, closes vulnerabilities, and rebuilds compromised operating systems from clean golden images.
• Recovery validates system health and returns systems to production under heightened continuous monitoring.
• Post-Incident Activity (Lessons Learned) analyzes response performance, produces final documentation, and updates defensive controls.

When a cybersecurity breach occurs, organizations must execute a disciplined, repeatable response process. NIST SP 800-61r2 establishes the authoritative incident response lifecycle across four core phases: 1) Preparation; 2) Detection & Analysis; 3) Containment, Eradication & Recovery; and 4) Post-Incident Activity (Lessons Learned).

Preparation occurs before an incident happens. It involves developing formal incident response plans, defining communication escalation matrices, establishing the Computer Security Incident Response Team (CSIRT), and acquiring forensic acquisition tools. Detection and Analysis monitors security telemetry, verifies true-positive security alerts, determines the scope and attack vector of the compromise, and categorizes incident severity.

Containment prevents the adversary from spreading further or exfiltrating additional data. Responders must prioritize logical network isolation (quarantining endpoints via EDR or switchport VLANs) over physical power disruption, because preserving volatile RAM is critical for forensic investigation. Once contained, Eradication completely purges the threat: formatting infected systems, reinstalling operating systems from verified clean golden images, patching exploited vulnerabilities, and resetting compromised service credentials. Recovery carefully restores systems to live production, validating business operations under heightened monitoring. Finally, the Post-Incident Activity phase convenes a formal 'Lessons Learned' review to document root causes and harden controls.

⚠️ Common Pearson VUE Exam Traps

• Immediately pulling the power cord during an incident; cutting power destroys critical volatile RAM evidence (active C2 connections, memory-injected malware).
• Skipping the Lessons Learned phase; failing to analyze root causes guarantees that the organization remains vulnerable to the exact same attack in the future.