Security Incident Response & Management Flashcards

What is the distinction between a security 'event' and a security 'incident'?

Answer: An event is any observable occurrence; an incident is an event that negatively impacts security

A security event is any observable system occurrence, while an incident is specifically an event that threatens or violates security policies, AUPs, or standard security practices.

During which incident response phase is forensic evidence collected and analyzed?

Answer: Detection & Analysis

The Detection & Analysis phase involves collecting, preserving, and analyzing evidence to understand the nature, scope, and impact of the incident.

What is the purpose of an Incident Response Retainer with an external security firm?

Answer: To ensure pre-negotiated access to specialized IR expertise when an incident occurs

An IR retainer pre-negotiates terms, pricing, and access with a specialized firm so organizations can quickly engage expert help during a major incident without delays.

During the eradication phase of incident response, what is the primary goal?

Answer: Removing all traces of the threat from the environment

Eradication focuses on completely removing the threat — including malware, backdoors, and unauthorized accounts — from all affected systems.

Which metric measures the average time between when an incident is detected and when it is fully contained?

Answer: Mean Time to Contain (MTTC)

Mean Time to Contain (MTTC) specifically measures the time elapsed from detection to successful containment of the threat.

What is a tabletop exercise in the context of incident response?

Answer: A discussion-based exercise where participants walk through a hypothetical incident scenario

A tabletop exercise is a low-cost, discussion-based drill where key stakeholders verbally walk through an incident scenario to identify gaps in the response plan without affecting real systems.

Which role is typically responsible for declaring a security incident and initiating the formal response process in a large organization?

Answer: Incident Response Manager or CISO

The Incident Response Manager or CISO typically holds the authority to formally declare an incident and activate the full IR plan, ensuring appropriate resources are mobilized.