Responding to an Incident: The Five Phases

The alert is real. People are nervous, phones are ringing, and everyone has an opinion. This is exactly when a plan saves the day. Incident response is the discipline of handling a security incident calmly and in the right order, to limit damage, recover and learn. In this lesson you will walk through the five phases and practice on a short scenario.

A shared structure

Several reference documents describe incident response life cycles, including guidance from NIST (nist.gov), international standards and ANSSI (cyber.gouv.fr). Their wording differs slightly, but the structure is similar. We will use five phases:

1. Preparation
2. Detection and analysis
3. Containment
4. Eradication and recovery
5. Lessons learned (post-incident review)

In practice, the phases overlap and loop. You may contain, discover a second compromised machine, and go back to analysis. That is normal.

Phase 1: Preparation

The best incident response is decided before the incident. Preparation includes:

• A written plan and roles: who leads, who investigates, who communicates, who decides to shut down a service.
• Contact lists: management, legal, communications, IT, service providers, insurers, and the national authorities, kept up to date and available offline.
• Tooling and access: logs available, monitoring in place, ability to isolate a machine quickly, forensic tools ready.
• Tested backups: stored in a way that an attacker with network access cannot erase them.
• Training and exercises: tabletops and technical drills, as seen in chapter 3.
• Severity criteria: a simple scale that tells everyone when a situation becomes an incident or a crisis.

A fire plan taped inside a drawer that no one has read is not preparation. A plan that has been rehearsed is.

Phase 2: Detection and analysis

An alert, a user report or an outside notification starts the process. The questions are:

• Is it real? Eliminate false positives quickly but carefully.
• What is affected? Which systems, accounts, data?
• What is the likely method? Use the IOC and TTP thinking of lesson 4.2 and ATT&CK of lesson 4.3.
• How serious is it? Apply the severity scale.
• What is the timeline? When did it start, what happened in which order?

Two habits matter. First, keep a log of your own actions with times: what you did, who decided, what you saw. Second, preserve evidence: before changing a system, consider what you may lose. Copy relevant logs and, when appropriate, capture memory or disk images. If legal action is possible, a documented chain of custody keeps the evidence usable.

Phase 3: Containment

Containment stops the spread. Short-term examples: isolating a machine from the network, disabling a compromised account, blocking a malicious address, revoking sessions and keys. Long-term examples: moving systems into a protected segment while they are cleaned.

The art lies in the trade-offs. Switching off a machine stops activity but may destroy volatile evidence and disrupt the business. Isolating it from the network preserves much of the evidence and cuts communication. Decisions like these should involve the people who own the business process. Also remember that a quiet adversary may notice containment and react; coordinate your actions so that all known access paths are cut at the same time rather than one by one.

Phase 4: Eradication and recovery

Eradication removes the cause: malicious files, unauthorized accounts, persistence mechanisms, exploited weaknesses. If you are unsure about what the adversary changed, the safest path is often to rebuild affected systems from trusted sources rather than "cleaning" them. Reset credentials that may have been exposed, including service accounts and keys.

Recovery returns systems to normal operation: restoring from verified backups, reconnecting systems progressively, applying patches and watching closely for signs of the adversary returning. Do not declare victory too early. Monitoring in the weeks after recovery is part of the response.

Phase 5: Lessons learned

A few days after the incident, when the dust has settled, hold a review with everyone involved. Use a blameless format and ask:

• What happened, in a precise timeline?
• What worked well? What slowed us down?
• Which detections would have caught it earlier?
• Which preventive measures would have avoided it?
• Which parts of the plan need updating?

Then track the actions with an owner and a date. A review that produces a nice report and no change has no value. This phase feeds directly back into preparation, closing the loop.

Communication and legal duties

• Internal communication: a single source of truth, short regular updates, and clear instructions to staff.
• Need-to-know: sensitive details stay within the response team, partly to avoid leaks and partly to prevent rumors.
• Personal data breaches: under the GDPR, a breach involving personal data generally must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and affected individuals may have to be informed. In France the authority is the CNIL. Involve your data protection officer and legal advisor early.
• Sector regulations: depending on your sector and size, other European or national rules may impose notification duties. Check current texts on official sources.
• Law enforcement and help: organizations in France can seek support through cybermalveillance.gouv.fr (especially smaller organizations and individuals) and ANSSI (cyber.gouv.fr), and may file a complaint. Keep your evidence organized for this.
• Ransom demands: do not decide alone. Official guidance generally advises against paying, and the decision involves legal, insurance and management considerations.

Common mistakes

• Wiping a machine immediately and destroying the evidence you needed.
• Using the compromised network or email to coordinate the response when the adversary may be reading it. Use a separate channel.
• Changing passwords of a few accounts while the adversary still has other access.
• Not writing anything down, then being unable to reconstruct events.
• Skipping the lessons learned phase because "the incident is over".

Your role as a junior

As a junior analyst you will not lead a major incident. You will, however, follow playbooks, collect evidence, keep notes and escalate fast. Learn to say clearly: "Here is what I see, here is how I know, here is what I do not know, and here is what I recommend." That sentence is worth more than a hundred commands.

Your turn: handle a scenario

At LabCorp, a workstation shows an alert: a script launched by an email attachment contacted an unknown address. The user is a finance employee with access to shared payroll folders. The alert fired 20 minutes ago. Write a short action list, organized by the five phases, indicating what you do in the next hour. Remember: this is a fictional lab scenario.

See a solution

1. Preparation (already in place): open the playbook for suspicious attachment execution, and confirm contacts for the incident lead and the IT administrator.
2. Detection and analysis: confirm that the alert is genuine; identify the user, machine and attachment; check what else the machine and account did since the email arrived; search whether other users received the same email; start a timeline in UTC and a written log of your actions.
3. Containment: isolate the workstation from the network (without powering it off, to preserve volatile data); temporarily revoke the user's sessions and reset the password; block the malicious address and the sender; ask email administrators to remove the message from other mailboxes.
4. Eradication and recovery: determine whether the shared folders were accessed abnormally; rebuild the workstation from a trusted image rather than trying to clean it; check for persistence on other machines; restore any affected files from verified backups; watch the account closely afterwards.
5. Lessons learned: hold a blameless review: why did the email reach the user, was the detection quick enough, should attachments of this type be restricted, did the playbook help? Assign owners for each improvement. If personal data of employees may have been accessed, involve the data protection officer to assess notification duties.

Portfolio step

Write incident-response-plan.md in 04-detection-response: a two-page response plan for a fictional small company, with the five phases, roles, contact list template and communication rules. Add your scenario solution as an appendix. A clear plan like this is an excellent sample for roles in a SOC, incident response or consulting.

In chapter 5 you will move to the environments where more and more systems live: the cloud, APIs and containers.