📖 What is NIST Incident Response Lifecycle?
The NIST Incident Response Lifecycle is a four-step framework consisting of Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity. This standardized process ensures that organizations handle security incidents in a structured manner to minimize damage and recover efficiently.
"Memorize the four phases in order. The exam often asks which activity, such as 'lessons learned,' belongs in which specific phase."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of NIST Incident Response Lifecycle?
- ▸ Preparation involves establishing response policies, training the CSIRT, and deploying monitoring tools to ensure the organization is ready to handle threats effectively.
- ▸ Detection and Analysis focuses on identifying anomalies through log review and alerts to determine the incident's scope, severity, and the specific attack vector.
- ▸ Containment, Eradication, and Recovery aims to stop the threat's spread, remove the root cause, and restore systems to normal operational status securely.
- ▸ Post-Incident Activity centers on the 'lessons learned' process, where the team documents the timeline and improves defenses to prevent future similar breaches.
🎯 How does NIST Incident Response Lifecycle appear on the CS0-003 Exam?
You may be asked to categorize a specific task, such as conducting a 'lessons learned' meeting or updating the incident response plan, and identify it as part of the Post-Incident Activity phase.
A scenario might describe an analyst disconnecting a compromised workstation from the VLAN to prevent lateral movement; you must identify this as the Containment step within the third phase of the lifecycle.
Expect questions that provide a list of actions, such as analyzing logs and restoring backups, and ask you to arrange them in the correct chronological order according to the NIST framework.
❓ Frequently Asked Questions
Why are Containment, Eradication, and Recovery grouped together into one phase?
These steps are often iterative. An analyst may contain a system, discover a secondary backdoor during eradication, and need to re-contain the environment, making these steps a fluid, combined operational stage.
What is the difference between an 'event' and an 'incident' during the Analysis phase?
An event is any observable occurrence in a network or system. An incident is a specific event that violates security policies or poses a genuine threat to the organization's assets.