Incident Response & Recovery

3 AM. Your phone buzzes.

"We have a problem." The message is from your company's monitoring system. Unusual login activity detected — 47 accounts accessed from an IP address in Eastern Europe in the last 20 minutes. Customer data is being exfiltrated. Right now.

What do you do? Do you shut down the servers? Call the CEO? Contact the FBI? Start investigating? All of the above?

If you do not have an incident response plan, the answer is panic. And panic is exactly what turns a containable incident into a headline-making disaster.

The companies that survive breaches are not the ones that never get hacked (everyone gets hacked). They are the ones that had a plan, practiced it, and executed it under pressure — like a fire drill, except the building is actually on fire.

What is incident response?

In the previous module, you learned that frameworks like NIST, SOC 2, and ISO 27001 all require a documented incident response plan. You also saw in Module 1 that defense in depth includes an "escape plan" — the rehearsed response to a breach. This module is that escape plan in full detail.

Incident response (IR) is the organized approach to addressing and managing a security breach or cyberattack. The goal: minimize damage, reduce recovery time, and learn from the incident to prevent it from happening again.

Think of it as emergency medicine for computers. When someone has a heart attack, paramedics do not improvise. They follow a protocol: assess, stabilize, transport, treat. Incident response is the same — a rehearsed sequence that works under pressure because you have practiced it when things were calm.

There Are No Dumb Questions

Does every company need an incident response plan?

Yes. It does not matter if you are 5 employees or 50,000. If you use technology and store data, you will face a security incident. The question is not "if" but "when" — and whether you will be ready.

What counts as a "security incident"?

Any event that threatens the confidentiality, integrity, or availability of your data or systems. This includes: unauthorized access, malware infection, data breach, DDoS attack, insider threat, ransomware, phishing success, lost/stolen device with sensitive data, and more.

The 6 phases of incident response

The NIST framework defines six phases. Every IR plan follows this structure:

Phase 1: Preparation

This is where 90% of IR success is determined — BEFORE anything happens.

Phases 2-5: When it happens

Detection

Here is what a real breach timeline looks like — notice how long attackers stay hidden:

Most breaches are not detected by the victim. They are reported by a third party (law enforcement, a customer, a security researcher). The average detection time is 258 days. That means attackers have been inside your network for 9 months before you notice.

Detection tools:

• SIEM (Security Information and Event Management) — aggregates logs, spots anomalies
• EDR (Endpoint Detection and Response) — monitors devices for suspicious behavior
• IDS/IPS — monitors network traffic for known attack patterns
• User reports — sometimes the alert is "my files are encrypted and there is a ransom note"

Containment

The first instinct is to shut everything down. Resist it. Shutting down servers destroys forensic evidence. Instead:

Eradication and Recovery

Once contained, remove the threat completely. This means deleting malware, closing backdoors, revoking compromised credentials, and patching the vulnerability that was exploited. Then restore from clean backups — backups that you have verified are not also compromised.

Monitor intensely for 30-90 days after recovery. Sophisticated attackers often plant multiple backdoors. If you only find one, they walk right back in through the other.

There Are No Dumb Questions

Should we pay the ransom in a ransomware attack?

Law enforcement generally advises against paying. Paying funds criminal organizations, and there is no guarantee you will get your data back — some attackers take the payment and disappear. However, some organizations pay because the alternative (weeks of downtime, lost data, potential loss of life in healthcare settings) is worse. The best answer: have backups tested and ready so you never face this decision.

When do we need to notify law enforcement?

It depends on what was compromised and where you operate. GDPR requires notification to supervisory authorities within 72 hours. US state breach notification laws vary — some require notification within 30 days, others 60. HIPAA requires notifying HHS and affected individuals within 60 days. Your IR plan should have a legal checklist for notification obligations. When in doubt, notify early — regulators punish delayed notification more harshly than the breach itself.

Phase 6: Lessons learned (the one everyone skips)

After the crisis is over, everyone wants to move on. Do not let them. The post-incident review is where you prevent the NEXT incident.

Questions to answer:

• What happened? (timeline of events)
• How did the attacker get in?
• How long were they inside before detection?
• What worked in our response? What did not?
• Were our playbooks adequate? What was missing?
• What technical changes do we need? (patching, segmentation, monitoring)
• What process changes do we need? (training, access controls, communication)
• Do we need to update our IR plan?

Back to the 3 AM phone call

Forty-seven accounts accessed from Eastern Europe. Customer data being exfiltrated in real time. With an incident response plan, the sequence is clear: the on-call analyst (Detection) identifies the anomaly, calls the IR lead, and the team isolates the affected systems within minutes (Containment). Forensics captures memory images and logs before anything is wiped. Legal checks notification obligations. PR prepares a holding statement. The breach is contained, the attacker is locked out, and evidence is preserved for law enforcement.

Without a plan, that same 3 AM phone call produces panic. Someone shuts down the servers and destroys the forensic evidence. Nobody knows who to call. The CEO finds out from Twitter. By morning, the breach is a headline.

The difference between these two outcomes is not technology — it is preparation. The companies that survive breaches are not the ones that never get hacked; they are the ones that practiced the fire drill before the building caught fire.

Key takeaways

• Incident response is the organized approach to handling security breaches — like emergency medicine for computers
• The 6 NIST phases: Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned
• Preparation is 90% of success — build the team, write playbooks, practice with tabletop exercises
• Average breach takes 258 days to detect — invest in SIEM, EDR, and monitoring
• Contain first, then eradicate — do not destroy evidence by shutting everything down
• Lessons learned is the most important phase — no blame, only improvement
• Companies with tested IR plans save 54% on breach costs

Next up: You have now learned every pillar of cybersecurity — threats, networks, cryptography, identity, frameworks, and incident response. The final module maps it all to a career. You will discover the eight major cybersecurity roles, the certification roadmap from Security+ to CISSP, five paths to break into the field without a CS degree, and how to build your first 90-day plan.