incident-response

Incident Response Skill

Purpose

This skill establishes comprehensive procedures for detecting, analyzing, containing, eradicating, and recovering from security incidents affecting the CIA platform. It implements systematic incident management aligned with NIST SP 800-61r2, ISO 27035, and Hack23 ISMS Incident Response Plan with measurable response times and transparent communication.

When to Use This Skill

Apply this skill when:

• ✅ Detecting security alerts or suspicious activity
• ✅ Responding to security breaches or data exposure
• ✅ Managing vulnerability exploitation incidents
• ✅ Coordinating response to service disruptions
• ✅ Handling supply chain security incidents
• ✅ Meeting GDPR 72-hour breach notification requirements
• ✅ Conducting post-incident analysis and lessons learned
• ✅ Updating incident response playbooks

Do NOT use for:

• ❌ Routine maintenance or planned downtime
• ❌ Non-security operational issues
• ❌ Performance degradation without security implications

Decision Tree

%%{
  init: {
    'theme': 'base',
    'themeVariables': {
      'primaryColor': '#D32F2F',
      'primaryTextColor': '#fff',
      'lineColor': '#D32F2F',
      'secondaryColor': '#FF9800',
      'tertiaryColor': '#4CAF50'
    }
  }
}%%
flowchart TD
    DETECT["🔍 Incident Detected"] --> VALIDATE{"✅ Confirmed<br/>Security Incident?"}
    
    VALIDATE -->|YES| CLASSIFY{"🏷️ Classify Severity"}
    VALIDATE -->|NO| FALSE["📋 False Positive<br/>Document & Close"]
    
    CLASSIFY -->|🔴 Critical<br/>€10K+ daily loss| S1["🔴 S1: Critical Response<br/>RTO: 30 min<br/>All Stakeholders"]
    CLASSIFY -->|🟠 High<br/>€5-10K daily loss| S2["🟠 S2: High Response<br/>RTO: 1 hour<br/>Key Stakeholders"]
    CLASSIFY -->|🟡 Medium<br/>€1-5K daily loss| S3["🟡 S3: Medium Response<br/>RTO: 4 hours<br/>Internal Only"]
    CLASSIFY -->|🟢 Low<br/><€1K daily loss| S4["🟢 S4: Low Response<br/>RTO: 24 hours<br/>Documentation"]
    
    S1 --> ACTIVATE["🚨 Activate Response Team<br/>CEO + Specialists"]
    S2 --> ACTIVATE
    S3 --> ACTIVATE
    S4 --> ACTIVATE
    
    ACTIVATE --> CONTAIN["🛡️ Containment<br/>Isolate & Preserve"]
    CONTAIN --> INVESTIGATE["🔬 Investigation<br/>Root Cause Analysis"]
    INVESTIGATE --> REMEDIATE["🔧 Remediation<br/>Fix & Restore"]
    REMEDIATE --> VALIDATE_FIX{"✅ Validated?"}
    
    VALIDATE_FIX -->|NO| REMEDIATE
    VALIDATE_FIX -->|YES| NOTIFY{"📢 External<br/>Notification<br/>Required?"}
    
    NOTIFY -->|YES - GDPR| GDPR["📢 GDPR Notification<br/>72-hour deadline"]
    NOTIFY -->|YES - NIS2| NIS2["📢 NIS2 Notification<br/>24-hour initial"]
    NOTIFY -->|YES - Customers| CUSTOMER["📢 Customer Notice<br/>Per SLA"]
    NOTIFY -->|NO| DOCUMENT
    
    GDPR --> DOCUMENT["📝 Incident Report"]
    NIS2 --> DOCUMENT
    CUSTOMER --> DOCUMENT
    
    DOCUMENT --> LESSONS["📈 Lessons Learned<br/>Process Improvement"]
    LESSONS --> CLOSE["✅ Close Incident<br/>Archive Evidence"]
    CLOSE --> MONITOR["🔄 Continuous Monitoring"]
    
    style DETECT fill:#2196F3,color:#fff
    style S1 fill:#D32F2F,color:#fff
    style S2 fill:#FF9800,color:#fff
    style S3 fill:#FFC107,color:#000
    style S4 fill:#4CAF50,color:#fff
    style CONTAIN fill:#7B1FA2,color:#fff
    style INVESTIGATE fill:#1565C0,color:#fff
    style REMEDIATE fill:#FF9800,color:#fff
    style CLOSE fill:#4CAF50,color:#fff

Incident Severity Classification

Severity Matrix

Incident Classification Examples

🔴 S1: Critical Incidents

• Ransomware infection affecting production systems
• Active data breach with PII exposure
• Complete service outage affecting all users
• Successful credential theft with admin access
• Criminal liability (GDPR Article 83 violations)

🟠 S2: High Incidents

• Exploitation of critical vulnerability (CVSS 9.0+)
• Partial data exposure (limited user data)
• Major service degradation (>50% users affected)
• Unauthorized access to sensitive systems
• Regulatory investigation triggered

🟡 S3: Medium Incidents

• Attempted exploitation (blocked by controls)
• Security misconfigurations discovered
• Malware detected and quarantined
• Moderate service impact (<50% users)
• Minor compliance violations

🟢 S4: Low Incidents

• Failed login attempts (below threshold)
• Security scan false positives
• Minor policy violations
• Suspicious activity with no impact
• Documentation issues

Incident Response Lifecycle

Phase 1: Preparation

Pre-Incident Readiness:

Incident_Response_Team:
  - CEO: James Pether Sörling (Incident Commander)
  - Security Lead: Primary responder
  - Development Lead: Technical remediation
  - External Consultant: On-call security expert
  - Legal Counsel: GDPR/regulatory compliance
  - Insurance Provider: Cyber insurance liaison

Tools_and_Resources:
  - AWS Detective: Log analysis and investigation
  - AWS Security Hub: Centralized security findings
  - AWS GuardDuty: Threat detection
  - GitHub Security: Repository security monitoring
  - CloudWatch Logs Insights: Query and analysis
  - Incident Response Playbooks: Scenario-specific procedures

Communication_Channels:
  - Primary: CEO email ([email protected])
  - Secondary: GitHub Issues (private security issues)
  - Emergency: AWS Support (Enterprise plan)
  - External: External Stakeholder Registry contacts
  - Documentation: ISMS-PUBLIC repository updates

Evidence_Preservation:
  - AWS CloudTrail: 90-day retention
  - Application Logs: CloudWatch 30-day retention
  - Database Audit Logs: 90-day retention
  - Network Flow Logs: VPC Flow Logs 7-day retention
  - Backup Snapshots: Automated daily backups

Preparation Checklist:

• Incident Response Plan: Reviewed and updated quarterly
• Contact List: Current and tested (External Stakeholder Registry)
• Playbooks: Scenario-specific procedures documented
• Tools: AWS security services enabled and monitored
• Training: Annual tabletop exercises conducted
• Backups: Verified and tested monthly
• Insurance: Cyber insurance policy active and adequate
• Legal: Retainer with legal counsel for GDPR compliance

Phase 2: Detection and Analysis

Detection Sources:

flowchart LR
    subgraph "🔍 Automated Detection"
        GUARD[AWS GuardDuty<br/>Threat Detection]
        SECHUB[AWS Security Hub<br/>Findings Aggregation]
        CODEQL[CodeQL<br/>Code Scanning]
        DEPEND[Dependabot<br/>Vulnerability Alerts]
    end
    
    subgraph "👁️ Manual Detection"
        USER[User Report<br/>Security Concern]
        AUDIT[Security Audit<br/>Findings]
        RESEARCH[Security Researcher<br/>Disclosure]
        MONITOR[System Monitoring<br/>Anomalies]
    end
    
    subgraph "🎯 Incident Triage"
        VALIDATE[Validate Incident]
        CLASSIFY[Classify Severity]
        ASSIGN[Assign Response Team]
    end
    
    GUARD --> VALIDATE
    SECHUB --> VALIDATE
    CODEQL --> VALIDATE
    DEPEND --> VALIDATE
    USER --> VALIDATE
    AUDIT --> VALIDATE
    RESEARCH --> VALIDATE
    MONITOR --> VALIDATE
    
    VALIDATE --> CLASSIFY
    CLASSIFY --> ASSIGN
    
    style VALIDATE fill:#FF9800,color:#fff
    style CLASSIFY fill:#D32F2F,color:#fff
    style ASSIGN fill:#1565C0,color:#fff

Initial Assessment Checklist:

• Incident Confirmed: Validate security incident vs. false positive
• Scope Identified: Affected systems, data, and users documented
• Timeline Established: Initial detection and estimated start time
• Severity Classified: Using severity matrix (S1-S4)
• Evidence Preserved: Logs, snapshots, and artifacts collected
• Team Notified: Response team activated per severity level
• Stakeholders Informed: CEO notified within RTO
• Communication Plan: Notification requirements assessed

Analysis Activities:

# 1. Collect AWS CloudTrail logs
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \
  --start-time 2024-01-15T00:00:00Z \
  --end-time 2024-01-16T00:00:00Z \
  --max-results 100 \
  > incident-cloudtrail-logs.json

# 2. Query CloudWatch Logs
aws logs filter-log-events \
  --log-group-name /aws/lambda/cia-production \
  --start-time $(date -d '24 hours ago' +%s)000 \
  --filter-pattern "ERROR" \
  > incident-application-logs.txt

# 3. Check AWS GuardDuty findings
aws guardduty list-findings \
  --detector-id YOUR_DETECTOR_ID \
  --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \
  --sort-criteria '{"AttributeName":"updatedAt","OrderBy":"DESC"}' \
  > incident-guardduty-findings.json

# 4. Review AWS Security Hub findings
aws securityhub get-findings \
  --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}' \
  --max-results 100 \
  > incident-securityhub-findings.json

# 5. Analyze access patterns
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=SUSPECTED_USER \
  --start-time 2024-01-15T00:00:00Z \
  > incident-user-activity.json

# 6. Create evidence package
tar -czf incident-evidence-$(date +%Y%m%d-%H%M%S).tar.gz \
  incident-*.json incident-*.txt

Phase 3: Containment

Short-Term Containment:

Immediate_Actions:
  Network_Isolation:
    - Action: Isolate affected systems from network
    - Method: AWS Security Group rule changes
    

---

*Content truncated.*