Cyber Security
Incident Response
Preparing for, handling and recovering from security incidents.
- 9 notes
- 74 minutes of reading
- The incident response lifecycle (NIST SP 800-61)The phases of incident response based on NIST SP 800-61: preparation, detection and analysis, containment, eradication, recovery and lessons learned, with what happens at each step. 8 min · Beginner
- Building an incident response plan and teamWhat goes into a practical incident response plan: team roles, contact lists, severity levels, decision authority, communication channels and playbooks, sized for small and large organisations. 8 min · Intermediate
- Responding to ransomware: the first hours, recovery and preventionA defender's guide to ransomware incidents: what to do in the first hours, how to isolate safely, protect and use backups, approach the payment decision, report the incident and prevent repeat attacks. 9 min · Intermediate
- Responding to phishing and compromised email accountsHow to triage reported phishing, find and remove every copy, and respond when an email account is compromised: session revocation, password and MFA resets, malicious rules, scoping and supporting users. 8 min · Intermediate
- Incident communication and legal duties: regulators, customers and evidenceHow to communicate during a security incident with staff, leaders, customers and the media, and the main legal duties such as the UK GDPR 72-hour breach notification, NIS rules and evidence preservation. 8 min · Intermediate
- Tabletop exercises: planning, running and learning from themHow to plan a discussion-based incident response exercise, write a realistic scenario with injects, facilitate the session and turn what you learn into tracked improvements. 8 min · Intermediate
- Incident response frameworks compared: NIST, SANS PICERL and ISO/IEC 27035How the main incident response models compare: the four NIST SP 800-61 Rev. 2 phases, the six SANS PICERL steps, the 2025 NIST Rev. 3 approach built on CSF 2.0, and ISO/IEC 27035, with advice on choosing one. 8 min · Intermediate
- Responding to denial-of-service attacks: detection, mitigation and preparationHow to recognise and respond to denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks: the main attack types, the first steps, mitigation through your provider, communication and how to prepare in advance. 8 min · Intermediate
- Handling insider threat incidents: malicious, negligent and compromised insidersHow to respond fairly and effectively when the threat comes from inside: the three types of insider, warning signs, working with HR and legal, protecting evidence and privacy, and the controls that reduce insider risk. 9 min · Intermediate