Incident response, step by step.
When an attack is confirmed, panic is the enemy. Professionals follow a calm, practised plan. Today you'll learn that plan and walk through a real-style ransomware case from start to finish.
The 6 phases (NIST / SANS model)
| Phase | Question | Example actions |
|---|---|---|
| 1. Preparation | Are we ready before anything happens? | Backups, logging, a written plan, contact list, training |
| 2. Identification | Is this really an incident? How big? | Triage alerts, confirm, decide severity |
| 3. Containment | How do we stop it spreading? | Disconnect infected machines, disable hacked accounts |
| 4. Eradication | How do we remove the attacker completely? | Delete malware, close the hole they used, reset passwords |
| 5. Recovery | How do we safely get back to normal? | Restore from clean backups, monitor closely |
| 6. Lessons learned | How do we stop it happening again? | Meeting, report, improve defences |
Notice that phase 1 happens before the attack. Most of incident response is won or lost in preparation.
Case study: ransomware at a Hyderabad pharma company
Monday 7:40 a.m. Identification
The SOC sees an alert: on one finance computer, hundreds of files are being renamed to .locked within minutes. An L1 analyst checks: a ransom note README_RESTORE.txt has appeared. Confirmed incident, high severity. The analyst escalates immediately and calls the incident lead.
7:52 a.m. Containment
- The infected computer is isolated from the network using the EDR tool (not switched off, to preserve memory evidence).
- The user's account is disabled.
- The team checks the SIEM: did that computer talk to others? Two more machines show the same activity: they're isolated too.
9:30 a.m. Investigation
Logs show the user opened an email attachment, "Invoice_Nov.xlsm", on Friday. It ran a macro that installed a hidden tool, which waited until Monday to encrypt files. That's the kill chain from Lesson 5.
Tuesday. Eradication
- Infected machines are wiped and rebuilt.
- The malicious email's sender and similar attachments are blocked company-wide.
- All finance passwords are reset; Office macros from the internet are blocked by policy.
Wednesday. Recovery
Files are restored from the offline backup made on Sunday night (3-2-1 rule!). Systems are monitored closely for a week.
Next week. Lessons learned
- Macros from internet files are now blocked for everyone.
- Phishing training for finance staff.
- The backup restore took 14 hours: they plan to make it faster.
Why did the team isolate the computer instead of switching it off?
Isolating cuts the network connection (containment) while keeping RAM, which may hold evidence (Lesson 2). Policies vary, but this is a common best practice.
Important habits during an incident
- Write everything down with times: who did what, when. This becomes the report.
- Don't tip off the attacker: for example, don't email "we found the hacker!" from an account that may be compromised.
- Communicate through agreed channels: management, legal, and in India, serious incidents must be reported to CERT-In (the national cyber agency) within 6 hours of noticing them, under its 2022 directions.
A SOC confirms an attacker is using a stolen employee account right now. What's the immediate next phase and action?
Stop the bleeding first. Investigation and recovery come after containment.
Module 3 test
A firewall that "blocks everything, then allows only what's needed" follows which principle?
Default deny is the firewall version of least privilege.
Which is TRUE about free VPN apps?
If you're not paying, your data may be the product.
In asymmetric encryption, people encrypt messages to you with your…
The public key locks; only your private key unlocks.
What does a SIEM do?
SIEM = central logs + search + alerts.
"Restore systems from clean backups and monitor closely" belongs to which phase?
Recovery is getting safely back to normal.
Under CERT-In's 2022 directions, serious cyber incidents in India must be reported within…
CERT-In requires reporting within 6 hours of noticing the incident.
Your task (15 min)
Write a one-page incident plan for your own family: (1) Preparation: list of important accounts, where backups are, bank helpline numbers, 1930. (2) What to do if a phone is lost: block SIM, change passwords, call bank. (3) Who to call. Keep it on paper at home. That's real preparation.
Lesson 12 complete!
You know the 6 phases of incident response and how to apply them, and you finished Module 3. Next module: how websites work and how they get hacked.
Next: How websites work →