incident-response

Security Incident Response

Overview

Security incident response is a critical process for handling security incidents. This skill provides methodologies, tools, and best practices for security incident response.

Response Process

1. Preparation Phase

Preparation work:

• Establish a response team
• Develop a response plan
• Prepare tools and resources
• Establish communication channels

2. Identification Phase

Identify incidents:

• Monitor alerts
• Anomaly detection
• Log analysis
• User reports

3. Containment Phase

Containment measures:

• Isolate affected systems
• Disable accounts
• Block network connections
• Back up evidence

4. Eradication Phase

Eradicate threats:

• Remove malware
• Fix vulnerabilities
• Reset credentials
• Clean up backdoors

5. Recovery Phase

Restore systems:

• Restore backups
• Verify system integrity
• Monitor systems
• Gradually restore services

6. Post-Incident Phase

Summarize experience:

• Incident report
• Lessons learned
• Improvement measures
• Update processes

Tool Usage

Log Analysis

Using Splunk:

# 搜索日志
index=security event_type="failed_login"

# 统计分析
index=security | stats count by src_ip

# 时间序列分析
index=security | timechart count by event_type

Using ELK:

# Elasticsearch查询
GET /logs/_search
{
  "query": {
    "match": {
      "event_type": "malware"
    }
  }
}

Forensics Tools

Using Volatility:

# 分析内存镜像
volatility -f memory.dump imageinfo

# 列出进程
volatility -f memory.dump --profile=Win7SP1x64 pslist

# 提取进程内存
volatility -f memory.dump --profile=Win7SP1x64 memdump -p 1234 -D output/

Using Autopsy:

# 启动Autopsy
# 创建案例
# 添加证据
# 分析数据

Network Analysis

Using Wireshark:

# 捕获流量
wireshark -i eth0

# 分析PCAP文件
wireshark -r capture.pcap

# 过滤流量
# 显示过滤器: ip.addr == 192.168.1.100
# 捕获过滤器: host 192.168.1.100

Using tcpdump:

# 捕获流量
tcpdump -i eth0 -w capture.pcap

# 分析流量
tcpdump -r capture.pcap -A

Incident Types

Malware

Response steps:

1. Isolate affected systems
2. Collect samples
3. Analyze malware
4. Remove threats
5. Fix vulnerabilities

Tools:

• VirusTotal
• Cuckoo Sandbox
• YARA rules

Data Breach

Response steps:

1. Confirm the scope of the breach
2. Contain the breach
3. Assess the impact
4. Notify relevant parties
5. Fix vulnerabilities

Check items:

• Amount of leaked data
• Affected users
• Leak channel
• Data sensitivity

Denial of Service

Response steps:

1. Confirm the attack type
2. Enable protection measures
3. Filter malicious traffic
4. Monitor system status
5. Restore normal services

Protection measures:

• DDoS protection services
• Traffic scrubbing
• Rate limiting measures
• CDN protection

Unauthorized Access

Response steps:

1. Disable affected accounts
2. Reset credentials
3. Check access logs
4. Assess data access
5. Fix vulnerabilities

Check items:

• Access time
• Accessed content
• Access source
• Data modification

Response Checklist

Preparation Phase

• Establish Response Team
• Develop Response Plan
• Prepare Tools
• Establish Communication Channels

Identification Phase

• Confirm Incident
• Collect Information
• Assess Impact
• Record Timeline

Containment Phase

• Isolate Systems
• Disable Accounts
• Block Connections
• Back Up Evidence

Eradication Phase

• Remove Threats
• Fix Vulnerabilities
• Reset Credentials
• Verify Eradication

Recovery Phase

• Restore Systems
• Verify Integrity
• Monitor Systems
• Restore Services

Post-Incident Phase

• Write Report
• Summarize Lessons Learned
• Improvement Measures
• Update Processes

Best Practices

1. Preparation

• Establish Response Team
• Develop Response Plan
• Conduct Regular Drills
• Prepare Tools

2. Response

• Respond Quickly
• Handle Systematically
• Record All Operations
• Protect Evidence

3. Communication

• Internal Communication
• External Notification
• Status Updates
• Post-Incident Report

4. Improvement

• Incident Analysis
• Process Improvement
• Tool Updates
• Training Enhancement

Precautions

• Respond Quickly
• Protect Evidence
• Record Operations
• Comply with Laws and Regulations