📘Cisco Certified CyberOps Associate (200-201 CBROPS)
🔷 What is Incident Handling?
Incident handling is the process used to:
- Detect
- Analyze
- Contain
- Remove
- Recover from
- Learn from
a security incident (such as malware infection, unauthorized access, or data breach).
The standard used is:
👉 NIST SP 800-61 (Computer Security Incident Handling Guide)
🔷 The 4 Phases of Incident Handling
According to NIST, there are 4 main phases:
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-Incident Activity
🟩 1. Preparation Phase
🔹 Purpose:
To get ready before an incident happens
🔹 Key Activities:
- Create an Incident Response Plan (IRP)
- Define roles and responsibilities
- Train the incident response team
- Set up tools and systems
- Maintain asset inventory
- Establish communication channels
🔹 Important Components:
- Security tools:
- SIEM (Security Information and Event Management)
- IDS/IPS (Intrusion Detection/Prevention Systems)
- Antivirus / EDR
- Documentation:
- Policies
- Procedures
- Contact lists
🔹 Example (IT-based):
- Configure SIEM to collect logs from servers and firewalls
- Maintain a list of critical servers and their owners
🔹 Exam Tips:
- Preparation is proactive
- Focuses on readiness and prevention
🟨 2. Detection and Analysis Phase
🔹 Purpose:
To identify whether an event is actually a security incident
🔹 Key Activities:
- Monitor alerts
- Analyze logs and data
- Confirm incident
- Determine scope and impact
🔹 Steps:
1. Event Detection
- Alerts from:
- SIEM
- IDS/IPS
- Antivirus
- Users
2. Event Analysis
- Check:
- Log files
- Network traffic
- System behavior
3. Incident Validation
- Determine:
- Is it a false positive or real attack?
4. Incident Classification
- Categorize:
- Malware
- Phishing
- Unauthorized access
- DoS attack
5. Prioritization
- Based on:
- Impact (high/medium/low)
- Sensitivity of affected system
🔹 Example (IT-based):
- SIEM alert shows multiple failed logins → analyze logs → confirm brute-force attack
🔹 Exam Tips:
- Focus on:
- Distinguishing events vs incidents
- False positives vs true positives
- Severity classification
🟥 3. Containment, Eradication, and Recovery
This is the main response phase
🔸 A. Containment
🔹 Purpose:
Stop the incident from spreading
🔹 Types:
- Short-term containment
- Immediate action
- Long-term containment
- Temporary fixes until full solution
🔹 Actions:
- Isolate infected system
- Block malicious IP addresses
- Disable compromised accounts
🔹 Example:
- Disconnect infected host from network
🔸 B. Eradication
🔹 Purpose:
Remove the root cause of the incident
🔹 Actions:
- Delete malware
- Remove unauthorized access
- Patch vulnerabilities
🔹 Example:
- Remove malicious files and close exploited ports
🔸 C. Recovery
🔹 Purpose:
Restore systems to normal operation
🔹 Actions:
- Restore from backups
- Reconnect systems to network
- Monitor for re-infection
🔹 Example:
- Restore clean server image and monitor logs
🔹 Exam Tips:
- Containment = stop spread
- Eradication = remove cause
- Recovery = restore operations
🟦 4. Post-Incident Activity
🔹 Purpose:
Learn from the incident and improve security
🔹 Key Activities:
- Conduct lessons learned meeting
- Document the incident
- Update policies and procedures
- Improve detection and response
🔹 Reporting:
- Incident reports include:
- Timeline
- Impact
- Actions taken
- Recommendations
🔹 Example:
- Update firewall rules after analyzing attack behavior
🔹 Exam Tips:
- Focus on:
- Documentation
- Process improvement
- Future prevention
🔷 Applying the Process to an Event (Important for Exam)
When given a scenario, you must:
Step 1: Identify the Phase
Ask:
- Is this preparation?
- Is this detection?
- Is this response?
- Is this post-incident?
Step 2: Identify the Correct Action
| Situation | Phase | Action |
|---|---|---|
| Writing IR plan | Preparation | Planning |
| SIEM alert triggered | Detection | Analyze logs |
| System isolated | Containment | Stop spread |
| Malware removed | Eradication | Clean system |
| System restored | Recovery | Resume operations |
| Report written | Post-Incident | Documentation |
🔷 Key Concepts You Must Know
🔹 1. Incident vs Event
- Event = Any observable activity
- Incident = Event that violates security policy
🔹 2. Indicators of Compromise (IoCs)
- Evidence of attack:
- Suspicious IP
- File hashes
- Domain names
🔹 3. Chain of Custody
- Track evidence handling for legal use
🔹 4. Communication
- Internal:
- Security team
- External:
- Management
- Legal teams
🔹 5. Documentation
- Every step must be recorded
🔷 Common Tools Used
- SIEM → Log analysis
- EDR → Endpoint detection
- IDS/IPS → Network monitoring
- Packet analyzers → Traffic inspection
🔷 Common Exam Questions Patterns
You may be asked to:
✔ Identify which phase an action belongs to
✔ Choose the correct next step in a scenario
✔ Differentiate between containment and eradication
✔ Recognize proper incident response workflow
✔ Identify incorrect actions in a phase
🔷 Quick Summary (Memory Trick)
👉 PDCR Model:
- P → Preparation
- D → Detection & Analysis
- C → Containment, Eradication, Recovery
- R → Reporting (Post-Incident)
🔷 Final Exam Tips
- Always think in order of phases
- Understand why each step is done
- Focus on decision-making in scenarios
- Know difference between:
- Detection vs Response
- Containment vs Eradication
- Event vs Incident
