Incident Response and Risk Management

Learning Objectives

• Explain what a security incident is and describe the stages of incident response in the correct order.
• Apply the idea of risk assessment by prioritizing risks according to their impact and likelihood.

Guiding Question

When a security incident happens, how should an organization respond in order, and how does it decide which risks to address first?

Even a well-protected system can be attacked. When a security incident happens, whether data is leaked, files are tampered with, or a service is knocked offline, a rushed and unplanned reaction only makes the damage worse. Organizations follow a clear, ordered response so that damage is contained, the cause is removed, and the same problem does not return. They also decide in advance which risks to guard against first, because no team can fix everything at once.

Going Deeper: how this lesson differs from the two before it

Lesson 2-1 was about protecting one connection. Lesson 2-2 was about designing a network so that one breach is not the end. This lesson starts from a harder admission: the attack succeeded anyway. Every measure in 2-2 can be in place and an incident can still happen, because people click things and software has flaws.

So the question changes from "how do we stop it" to "what do we do now, and in what order". Notice that the first of the six stages, preparation, happens before any incident. The response begins long before the attack does.

Contain first: isolate the infected machine.

1. What is a Security Incident

A security incident is a situation in which actual damage occurs due to an information security problem.

The word that carries the definition is actual. A weakness that nobody has used is not an incident. An incident is damage that has already happened.

Egyptian Example

A school's student records system is locked by ransomware on a Sunday morning, and staff cannot sign in. Real damage has occurred, so this is an incident. If the school had instead discovered that its password policy was weak, with nothing yet gone wrong, that would be a risk, which is the second half of this lesson.

2. The Flow of Incident Response

When a security incident occurs, the response proceeds through six stages, in this order.

It is important to proceed through the six stages in order. For example, if recovery is performed without identifying and removing the cause, the same incident may occur again.

FROM THE TEXTBOOK

Pause & Think

Why must containment come before eradication in the six-stage response?

Answer. Because containment stops the damage from growing, and eradication does not. Removing malware from one machine can take time, and while that work is going on, an infection that has not been contained is still spreading to other machines, so the problem you are solving keeps getting bigger than the solution. Containment is the stage that freezes the size of the incident; eradication then deals with a fixed problem instead of a growing one.

Going Deeper: the fire, and why the order is not a preference

Think of a fire in one room. Containment is shutting that door. Eradication is putting the fire out. Recovery is repainting the room. Prevention of recurrence is finding out that the wiring was faulty and replacing it.

Now take the stages out of order. Repaint before you put the fire out and you have wasted the paint. Put the fire out without shutting the door first and the rest of the house is burning while you work. Skip the wiring and you will be back in the same room next month. Each stage assumes the one before it is already done, which is exactly why the exam asks you to explain the order rather than to list it.

Rank risks by impact and likelihood; fix the worst first.

3. The Concept of Risk Assessment

A risk is the possibility of an information security problem occurring in the future, and its impact. Notice the difference from an incident: an incident has already happened, a risk has not happened yet.

The size of a risk is determined by two factors multiplied together:

Risk size = Impact × Likelihood

Risks with both high impact and high likelihood should be addressed first. Since it is difficult to address all risks at the same time, it is important to set priorities and take measures systematically.

Going Deeper: why it is multiplied and not added

Multiplying is what makes one small factor cancel a large one. A risk that would destroy the whole system but is almost impossible (impact 3, likelihood 1) scores 3. A nuisance that happens constantly (impact 1, likelihood 3) also scores 3. Add them instead and both would score 4, the same as a risk scoring 2 and 2, which hides the shape of the problem.

This is also why impact alone is not enough, which the textbook tests directly. A student who ranks by damage only will put the dramatic, almost impossible risk at the top and leave the everyday one unhandled.

Egyptian Example

A school weighs two risks. Another ransomware attack: impact large, likelihood high, because the first one already succeeded and nothing has changed. A brief power cut: impact small, because the work is saved and the building has a generator, and likelihood moderate. The ransomware is handled first, not because a power cut is unimportant, but because its two numbers are both high.

Key Terms