Introduction

This chapter covers the eighth objective in Domain 4.0, Security Operations of the CompTIA Security+ Exam.

In this chapter, we will review the incident response process, paying particular attention to the sequence of stages from preparation to lessons learned in our post-response analysis.

We will also discuss training practices, including interactive exercises and other methodologies, to prepare the team to deal effectively with these incidents. The final sections will explore root cause analysis, threat hunting, and digital forensics.

This chapter will give you an overview of how modern IT departments respond to security incidents and ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 4.8 will be provided at the end of the chapter.

Process

The incident response process is a structured approach used by organizations to identify, manage, and mitigate security incidents. These incidents could include cybersecurity breaches, data breaches, network intrusions, and other events that could harm an organization’s information systems or data.

Figure 21.1 illustrates a simple version of the incident response process:

Figure 21.1: Incident response process

The incident response process must be carried out in the following order:

1. Preparation: In the preparation phase, organizations establish and maintain incident response plans. These plans should be regularly updated to address evolving threats. This is the stage at which the Cybersecurity Incident Response Team (CSIRT) is assembled and a discrete communication plan established to notify them about any new incidents without advising the general public. It should only become available to the general public after the incident...

Attack Frameworks

The MITRE ATT&CK framework, the Cyber Kill Chain, and the diamond model of intrusion analysis are all valuable tools and concepts used in the field of cybersecurity to understand and defend against cyber threats. The following sections will investigate the benefit of each when dealing with incident response.

MITRE ATT&CK Framework

MITRE is a US government-sponsored company whose aim is to help prevent cyberattacks. They developed an online framework that can be used by the public, with many matrices that give information about adversaries and their attack methods.

On the MITRE website (https://attack.mitre.org), you will find a huge spreadsheet that you can use to find information on adversaries, their attack methods, and how to mitigate these attacks, which is invaluable information for everyone from cybersecurity teams to threat hunters. and comprises the following aspects:

• Adversarial: This looks at the behavior of potential attackers according...

Training

Incident response training is vital to any organization’s cyber defense strategy. The organization trains a team with the skills to swiftly detect, contain, and recover from digital attacks. Incident response teams undergo specialized training to fortify their digital domain. The following are some of the types of training that will be delivered:

• Security awareness training: Security awareness training is a proactive approach to educating employees about the latest cyber threats, safe online practices, and their role in protecting the organization. This training empowers employees to recognize potential threats and respond appropriately.
• Security policies and procedures: Understanding an organization’s security policies and incident response procedures is crucial. Training should ensure that responders know how to align their actions with these policies, ensuring compliance and consistency in their efforts.
• Incident handling: Responders should...

Testing

Disasters can strike at any time, and businesses must be well prepared to mitigate their impact. One crucial aspect of disaster preparedness is the implementation of exercises to ensure that your company is ready to respond effectively. These exercises may take the following forms, including tabletop exercises and simulations. A tabletop exercise is a valuable tool for testing your disaster recovery plan in a controlled setting. During this exercise, key stakeholders gather around a table to discuss and strategize how they would respond to a hypothetical disaster scenario. This exercise allows participants to identify gaps in their plan, refine communication channels, and assess decision-making processes. This exercise is the easiest to set up as it takes the least administrator effort as it is a paper-based exercise.

Simulations can also be conducted (either alone or in conjunction with other exercises) to introduce an element of competitiveness and urgency into disaster...

Root Cause Analysis

Incorporating Root Cause Analysis into disaster recovery exercises isn’t just about fixing past mistakes; it’s about shaping a better future. By identifying the root causes, organizations can make strategic decisions to fortify their systems, enhance their preparedness, and ultimately become more resilient in the face of adversity. Root Cause Analysis drills deep into the problems, while Lessons Learned looks at the actions taken and how the response can be improved in the future.

Threat Hunting

To embark on threat hunting, organizations obtain information from many sources like open-source intelligence (OSINT), attending conferences, threat feeds, advisories, and bulletins. This knowledge equips you to understand your network’s dynamics and identify real threats. Adopting an attacker’s mindset, you meticulously search for cyber-attack evidence while also unearthing vulnerabilities for immediate fortification. Sources of cybersecurity information include the following:

• Intelligence fusion: Intelligence fusion is the orchestration of diverse cybersecurity data sources into a unified, harmonious whole. It’s like combining different open-source intelligence, expert analysis, and up-to-the-minute updates to form a cohesive defense against cyber threats.
• Threat feeds: These feeds provide real-time information that allows cybersecurity professionals to stay one step ahead of adversaries. Platforms like Cyware and ThreatConnect aggregate...

Digital Forensics

In the world of cybersecurity, digital forensics is the detective work of the digital age, where skilled investigators uncover the digital breadcrumbs left behind by cybercriminals, shedding light on their criminal activities.

NIST SP 800-86, Guide to Integrating Forensic Techniques into Incidents, breaks down the forensic process consists of four phases:

Figure 21.3: Forensics process

The phases illustrated in Figure 21.3 can be described as follows:

1. Collection: Law enforcement collects evidence from a crime scene, ensuring that the integrity of the evidence is maintained and that it is bagged and tagged ready for a forensic examination.
2. Examination: Prior to examination, the data will be hashed, and then an investigation will be carried out with the relevant forensic tool. When the examination has concluded, the data is once again hashed to ensure that neither the examiner nor the tools have tampered with it.
3. Analysis...

Summary

This chapter covered the incident response process, from Preparation to Lessons Learned. We reviewed every stage of this process from the assembly and training of a CSIRT to digital forensics and the investigation and analysis of collected evidence to identity and address threat incidents as they occur. The final sections also examined the chain of custody process, which ensures evidence has been accounted for between an arrest and a day in court.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 4.8 in your CompTIA Security+ certification exam.

The next chapter will be Chapter 22, Given a scenario, use data sources to support an investigation.

Exam Objectives 4.8

Explain appropriate incident response activities.

• Process: Sequential steps for effective incident management:
  • Preparation: Laying the groundwork before incidents strike
  • Detection: Spotting anomalies and intrusions in real-time
  • Analysis: Unraveling incidents’ scope and impact
  • Containment: Preventing threats from spreading further
  • Eradication: Eliminating the root causes of incidents
  • Recovery: Restoring systems to normal operations
  • Lessons Learned: Post-incident reflections for improvement
• Training: Keeping response teams skilled and prepared
• Testing: Validating response plans with exercises and simulations:
  • Tabletop exercise: Collaborative scenario testing for response plan assessment
  • Simulation: Realistic, hands-on practice to assess incident response strategies
• Root Cause Analysis: Unearthing why incidents occurred
• Threat hunting: Proactive pursuit of potential threats
• Digital forensics: Delving into digital artifacts for evidence:
  • Legal...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. You are the lead incident responder for a large organization’s cybersecurity team. During the Analysis phase of incident response, you discover a sophisticated malware infection on a critical server that contains sensitive data and supports critical business operations. What should be your immediate action?
   1. Isolate the server and proceed with root cause analysis.
   2. Disconnect the server from the network and restore from backups.
   3. Immediately report the incident to legal authorities.
   4. Conduct a tabletop exercise to assess incident response procedures.
2. You are the cybersecurity...