PATCH//NOTES Open the interactive version
← All lessons
Defence · Intermediate · 4 min

Incident response

What to do in the worst hour of the year.

What it is

Incident response (IR) is the plan for when something goes wrong. The classic phases: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Lessons Learned. The first instinct, wiping the machine, can destroy evidence. Good IR teams contain first (isolate the host, disable the account), preserve evidence, find the root cause and then rebuild. Clear communication matters as much as technical skill.

Real case · 2024

CrowdStrike outage

Not an attack: a faulty security update crashed about 8.5 million Windows machines worldwide. It showed that IR plans need to cover outages and recovery at scale, not just hackers.

Source: Wikipedia: 2024 CrowdStrike-related IT outages

How defenders stop it

  • Write and rehearse a plan before you need it (tabletop exercises)
  • Know who to call: legal, comms, insurers, law enforcement
  • Keep offline copies of critical contacts and runbooks
  • Run a blameless post-incident review

Try it yourself

Work through incident labs on CyberDefenders

Check yourself

1. You find malware on a laptop. What should usually come first?

  1. Wipe and reinstall it immediately
  2. Isolate it from the network and preserve evidence
  3. Email everyone in the company
  4. Pay any ransom
Show answer

Isolate it from the network and preserve evidence. Containment stops the spread; evidence tells you how they got in.

2. Why can wiping an infected machine straight away be a mistake?

  1. It destroys evidence you need to find the root cause
  2. It spreads the malware
  3. Wiping is illegal
  4. It voids the warranty
Show answer

It destroys evidence you need to find the root cause. Contain first and preserve evidence; otherwise you may never learn how the attacker got in, and they'll come back.

3. What's the final phase of the classic incident response cycle?

  1. Detection and analysis
  2. Containment
  3. Lessons learned
  4. Preparation
Show answer

Lessons learned. The cycle ends with a blameless review so the same incident doesn't happen again.

Answer them in the app to earn XP.

Next: OSINT →