Incident Response: The Complete Guide to Being Ready

1. Definitions and stakes

In information security, digital forensics covers the methods and procedures used to collect, preserve and analyze evidence from compromised information systems: logs, memory images, network traces, altered files and so on. The goal is to reconstruct the timeline of the attack, identify who was behind it and preserve the integrity of the evidence for potential legal proceedings or internal disciplinary action.

Incident response, for its part, covers everything that happens from the moment a compromise is detected: identifying the threat, containing the affected perimeter, eradicating the malware, restoring services and drawing lessons from the event. The approach relies on standardized processes (ISO 27035, NIST SP 800-61) and aims to limit the operational impact while getting systems back into production quickly and safely.

Handling security incidents properly addresses several concerns:

• Protecting sensitive data: preventing or limiting exfiltration and leaks of confidential information.
• Business continuity: reducing service interruptions (for end users and employees alike), which translate directly into financial losses.
• Reputation and trust: handling an incident well reinforces your image of reliability with clients and partners, and shows the affected organization is acting in good faith.
• Regulatory compliance: meeting your obligations (GDPR, the French LPM, PCI-DSS and others) and being ready for potential audits.

2. The main types of security incidents

A security event is any action, behavior or situation that is detected and could potentially pose a risk to the security of the information system, without it being established yet that it constitutes a real, confirmed threat.

Cybersecurity incidents are events that actually compromise the confidentiality, integrity or availability of information systems. Here are some of the most common types of incidents and their impacts.

Ransomware

Ransomware is one of the most damaging threats today. Modern campaigns often combine data theft, encryption and blackmail through the threat of disclosure (double or triple extortion).

Phishing and social engineering

Phishing remains the number one entry point for compromises. It comes in several forms: fraudulent emails, instant messages, phone calls (vishing) and sometimes even in-person encounters. Social engineering can target IT or accounting and finance teams, in CEO fraud schemes for instance.

DDoS: Distributed denial of service

These attacks aim to cause a service outage through a massive volume of requests. They can be purely technical, but they can also serve as a diversion during another intrusion attempt, or as a way to pressure the organization (DDoS extortion). The botnets involved (Mirai, Mantis and others) can generate several terabits of traffic.

Supply chain attacks

Increasingly common, these techniques involve poisoning upstream a piece of software, a library or an infrastructure used by the target. They are hard to detect because they usually travel through "trusted" channels. Well-known examples include SolarWinds, XZ Utils and Codecov.

Insider threats

These security incidents can stem from malicious behavior (data theft, sabotage) or from plain negligence (mishandling, publishing sensitive files). They are especially hard to manage because they come from actors who already hold legitimate access to the information system.

3. The 5 key phases of an incident response process

Managing an incident is an "exceptional" event that generates real stress, both because it is unusual and because of the urgency it imposes and the critical stakes it raises.

For that reason, it is vital not to give in to the pressure and to proceed methodically. This is why, building on the operational framework published by the French national cybersecurity agency (ANSSI), itself based on ISO 27035, and enriched with our own field experience, we break an incident down into the following 5 phases:

Phase 1: Preparation

The first phase takes place before any crisis. It consists of laying the groundwork so that on the day of the incident you save time and operate as efficiently and as methodically as possible. Here are some of the tasks to carry out during this phase:

• Write an incident response plan describing the steps to follow when facing a threat. The plan should cover several areas: detection, analysis, containment, eradication, remediation and recovery. It should also include the communication channels to activate depending on the severity of the incident (internal, partners, authorities, clients), along with the criteria that trigger an escalation. This living document should be tested and updated regularly through simulation exercises, both to evaluate its effectiveness and to train the teams who will apply it.
• Set up a CSIRT (Computer Security Incident Response Team) with formalized roles and responsibilities, whose members are listed in the incident response plan. The team should have internal and external communication procedures and detection indicators identified in advance.
• Deploy a SIEM (Security Information and Event Management): a tool that centralizes logs. Having all your logs in a single place matters a great deal when it comes to handling an incident well. The SIEM will hold, for example, system and application authentication logs, network traces from the various firewalls, and logs from web servers or other applications.
• Write playbooks: simple security guides, written like cooking recipes and referenced in the incident response plan, that let you follow a methodology prepared in advance for each type of incident you may face.
• Make sure backups exist for all critical systems in the infrastructure. They will allow you to restore systems to a pre-compromise state, and they are indispensable in ransomware incidents in particular.

We also recommend running an incident response readiness audit, which takes stock of the incident response plan and the maturity of your processes in the event of an incident.

Phase 2: Identification

As soon as an alert is raised by the mechanisms put in place during the preparation phase (EDR, a report from a user, and so on), the incident response team mobilizes to identify the origin and nature of the event. This step, which should be detailed in the incident response plan, aims to confirm that you are dealing with a genuine security incident rather than a false positive.

The analysts then examine the activity logs without wasting time. They extract indicators of compromise and assess the affected perimeter. The more precise the qualification (type of malware, attack vector, extent of the damage), the more effective the response that follows.

Phase 3: Containment and analysis

Once the incident has been detected, containment actions are triggered to limit any spread and prevent further malicious activity by the attacker. This means:

• Isolating the affected network zones
• Shutting down the applications concerned (or at least switching them to degraded mode)
• Blocking compromised accounts
• Seizing the physical systems involved
• Preserving the artifacts created by the attackers (logs, memory and disk captures)

The stakes here are twofold: stopping the attacker from spreading while guaranteeing that intact evidence is preserved.

Getting both right is essential, and it determines the quality of the rest of the investigation. In particular, evidence must be acquired and handled in a methodical, documented way, especially if legal action may follow later.

The forensic analysis can begin in parallel with this phase. Its objective is to determine precisely, from the evidence collected, what led to the compromise and what actions the attackers carried out.

Among other things, this analysis produces a list of indicators of compromise (IoCs) that helps identify every affected element (servers, workstations, equipment, accounts and so on) and understand how the attackers operated.

Phase 4: Eradicating the threat

Depending on the scale of the incident, it may be necessary (in the case of a fully compromised information system, for example) to rebuild what ANSSI calls a "core of trust". This clean environment then becomes the starting point for deploying the eradication tools and actions.

Examples:

Deploying a new Active Directory after the old one was compromised; creating new network zones that the attacker cannot reach;

Once the core of trust is in place, eradication can begin. Based on the results of the forensic analysis and the indicators of compromise identified, the technical teams proceed to eliminate the threat for good:

1. Removing the malware and neutralizing backdoors (usually done automatically and centrally through an EDR)
2. Blacklisting the identified malicious IPs on the firewalls
3. Fixing the vulnerabilities that were exploited

Phase 5: Recovery

Once the threat has been eradicated, the priority is to bring systems back online and apply the fixes identified during the previous phases. Data and services are restored progressively, from clean backups, taking care not to reintroduce the exploited vulnerabilities or restore any backdoors. To that end, every component brought back into service goes through rigorous checks:

• Verifying the absence of inactive or compromised accounts
• Validating hardened configurations (firewalls, network segmentation, access policies)
• Running non-regression tests to make sure the fixes applied do not create new weaknesses

This phase, which can stretch over several weeks or even months, is part of a continuous hardening effort: beyond applying critical patches and strengthening system configurations, it also means introducing regular security audits to measure how effective the measures in place are and to detect any new weakness proactively.

Formally closing the security incident goes hand in hand with a lessons-learned session. It reviews detection and reaction times, whether the procedures held up, how well the teams coordinated and the quality of the communications. The findings from this debrief feed back into the incident response processes through updates to response plans, audit frameworks and training programs, closing the continuous improvement loop the organization needs to build resilience against future threats.

4. Lessons from the field and the main pitfalls

Our consultants have handled all kinds of forensic engagements, from a simple sanity check after someone opened a phishing attachment to ransomware paralyzing a fleet of several thousand workstations. Drawing on those experiences, we want to highlight the 3 major pitfalls we have encountered.

Trying to move too fast

Wanting to move as quickly as possible is understandable, but the recovery phase should only begin once you have a high level of confidence that all the backdoors and indicators of compromise have been identified. During one of our forensic investigations, a company in a rush to resume operations urgently replaced the hard drives of its entire workforce (several hundred people) before the analyses were complete.

A few days later, a server that had only been partially examined allowed the attackers to come back, steal the credentials of an administrator account and reinfect the Active Directory along with the brand-new workstations: two outages, two bills.

Destroying evidence while trying to fix the flaws

The first instinct when facing a malicious file or binary is usually to delete it as fast as possible. Yet that deletion deprives the analysts of the elements they need to reconstruct the timeline of the attack, detect data exfiltration or uncover other implants. Before any containment or eradication measure, it is therefore imperative to take full acquisitions (physical if possible, logical otherwise) of the affected systems. Without them, there is no way to be certain you have understood the attack in its entirety and removed every one of the attacker's backdoors.

Choosing the wrong partner

Handling a security incident requires specific tools and skills: acquiring, preserving and tracking evidence, mastering the logs specific to each platform, and being able to guide strategic decisions under pressure. Entrusting the mission to a "generalist" provider because the company already knows them is tempting given the urgency of the situation, but it exposes the organization to several risks:

• an investigation that stalls for lack of method or specialization
• prolonged downtime of the information system and the associated extra costs (lost revenue, contractual penalties)
• communication mistakes that damage the company's reputation and complicate the regulatory side (GDPR notifications, insurers, authorities)

Bringing in a dedicated team, well versed in incident response procedures and crisis management, dramatically reduces both the stress and the impact of the incident.

5. Conclusion

When a cyberattack strikes, every second counts. It is easy to scatter your efforts or make bad decisions under pressure, which prolongs the attack and drives up the financial losses.

Every year, more than 40% of French companies report falling victim to a cyberattack, which is why preparing to react quickly and effectively is vital. With that in mind, our advice is the following:

• Prepare in advance: build a solid technical foundation (exhaustive logging, offline backups, forensic collection tools) and documented security procedures.
• Train regularly: run crisis exercises and attack simulations to sharpen coordination, verify reaction times and adjust your plans.
• Rely on an expert partner: choose a provider specialized in incident response, able to mobilize a multidisciplinary team quickly and provide strategic, technical and regulatory support.
• Audit and harden continuously: run periodic security audits, apply critical patches without delay and keep your best-practice baselines up to date to prevent any recurrence.

Whether you are preparing ahead of time or actively working through an incident, feel free to take a look at our incident response and incident response readiness audit offerings!

FAQ - Frequently asked questions