Security Incident Responder

Security Incident Responder

Overview

Security incident response is the organized approach to handling security breaches and attacks. The goal is to minimize damage, reduce recovery time, and prevent recurrence. This skill covers the complete incident response lifecycle from preparation through lessons learned, with practical playbooks for common incident types.

NIST Incident Response Lifecycle

1. PREPARATION
   -> Policies, procedures, tools, training, communication channels

2. DETECTION & ANALYSIS
   -> Monitoring, alerting, triage, investigation, classification

3. CONTAINMENT, ERADICATION & RECOVERY
   -> Short-term containment, evidence collection, root cause removal, restoration

4. POST-INCIDENT ACTIVITY
   -> Lessons learned, process improvements, metric tracking