Lion Cipher Lab
Write an incident response plan
- GRC / Compliance
- Beginner
- ~60 min
- Free · no account required
Why it matters
Sooner or later something goes wrong -- an account gets phished, a laptop gets encrypted and held for ransom, a strange login appears from another country. The moment that happens is the worst possible time to be figuring out who is in charge, what to unplug, who to call, and in what order. An incident response plan is the short written document that decides all of that in advance, so that when the alarm goes off people follow a rehearsed script instead of panicking. It is one of the highest-leverage documents in security because incidents are not a maybe -- they are a when -- and the…
What you'll learn
- what a security incident is, and what incident response (IR) means
- the NIST incident-response lifecycle: Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity
- defining incident-response roles (who is in charge, who does the technical work, who is informed)
- building a severity table (SEV levels) and escalation criteria -- how bad, and who gets woken up
- drafting a contact tree so the right people are reachable during an incident
- what containment, eradication, and recovery each actually mean
- writing a step-by-step playbook for a common incident type
- a ready-to-run phishing playbook
- a ready-to-run ransomware playbook
- running a post-incident review (a 'post-mortem' / lessons-learned) so the same thing does not happen twice
Steps in this lab
- What an incident is, what IR is, and why this plan exists
- The lifecycle -- the four phases every plan is built on
- Open a document and lay out the plan skeleton
- Preparation, part 1 -- roles and responsibilities
- Preparation, part 2 -- severity levels and escalation
- Preparation, part 3 -- the contact tree
- Detection & analysis -- noticing, then confirming
- Containment, eradication, and recovery -- the three that get confused
- Post-incident activity -- the review that stops a repeat
- Playbook 1 -- phishing (define it, then the steps)
- Playbook 2 -- ransomware (define it, then the steps)
- Assemble the one plan -- fill in the template
- What you built, and the mindset to keep