3.3 Explain the preparation and post-incident activity phases of the incident management life cycle

📘CompTIA CySA+ (CS0-003)

1. Forensic Analysis

What it means

Forensic analysis is the process of collecting, preserving, and analyzing digital evidence from systems after a security incident.

The goal is to understand:

What exactly happened
How the attacker entered the system
What systems or data were affected
What actions the attacker performed

What is done in forensic analysis

1. Evidence collection

Security teams collect data from:

Server logs (Windows Event Logs, Linux syslog)
Network traffic logs (firewalls, IDS/IPS)
Endpoint data (laptops, desktops, servers)
Memory dumps (RAM analysis)
Disk images (full copy of storage drives)

👉 Important: Evidence must be preserved without modification

2. Chain of custody

This ensures evidence is:

Properly documented
Not tampered with
Traceable from collection to analysis

This is important for legal and compliance purposes.

3. Analysis of evidence

Security analysts look for:

Malware files
Suspicious login attempts
Unauthorized access
Lateral movement inside the network
Data exfiltration activity

Example in IT environment

A company detects unusual data transfer from a database server.

Forensic analysis may show:

An attacker used stolen credentials
Logged into a VPN from an unusual location
Accessed customer database
Exported sensitive records using SQL queries

2. Root Cause Analysis (RCA)

What it means

Root cause analysis is the process of finding the main reason the incident happened in the first place.

It goes beyond symptoms and focuses on the actual weakness or failure.

What RCA tries to identify

How did the attacker get access?
What vulnerability was exploited?
Was there a misconfiguration?
Was a patch missing?
Was user error involved?
Was security monitoring insufficient?

Steps in root cause analysis

1. Identify the entry point

Example:

Phishing email
Unpatched software vulnerability
Weak password
Misconfigured firewall rule

2. Analyze failure points

Check what failed:

No email filtering (spam/phishing protection)
No MFA enabled
Outdated software version
Weak access control policies

3. Determine underlying cause

Example:

Not just “phishing email worked”
But “users were not trained + no email filtering system in place”

Example in IT environment

Incident: Malware spread in company network

Root cause analysis finds:

Employee clicked malicious email attachment
Endpoint protection was outdated
No application whitelisting was enabled

👉 Root cause = Weak endpoint security + lack of user awareness

3. Lessons Learned

What it means

Lessons learned is the process of reviewing the incident to improve future security and response actions.

It focuses on:

What went well
What failed
What should be improved

What is included in lessons learned

1. Incident review meeting

Security team, IT team, and management discuss:

Timeline of the incident
Detection methods
Response effectiveness
Communication issues

2. Improvement actions

Based on findings, organizations update:

Security policies
Incident response plans
Monitoring tools
Access controls
Employee training programs

3. Documentation

All findings are recorded in an incident report, including:

Summary of incident
Impact
Root cause
Response actions
Recommendations

Example in IT environment

After a ransomware incident:

Lessons learned may include:

Need better email filtering for phishing protection
Enable endpoint detection and response (EDR)
Improve backup strategy (offline backups)
Conduct regular phishing awareness training
Improve incident detection alerts

How these three work together

After an incident:

Forensic Analysis
→ Collects evidence and shows what happened
Root Cause Analysis
→ Finds why it happened
Lessons Learned
→ Improves future security to prevent it happening again

Exam Key Points (Very Important)

For CySA+ CS0-003, remember:

Forensic Analysis:

Focus on evidence collection and preservation
Includes logs, memory, disk images
Must maintain chain of custody

Root Cause Analysis:

Focus on why the incident happened
Identifies vulnerabilities or misconfigurations
Goes beyond symptoms

Lessons Learned:

Focus on improvement and prevention
Updates policies, tools, and training
Documented in post-incident report