Incident response lifecycle — NIST 800-61 phases — DevSecOps & Security Automation

When the detection and response tooling from Module 4 surfaces a genuine incident, a structured process is what turns chaos into a controlled recovery. NIST Special Publication 800-61 defines the industry-standard lifecycle in four phases: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity. This lesson walks through each phase, showing how they connect into a single repeatable cycle rather than four isolated activities performed in a vacuum.

Analogy🏏Cricket

🏏 The incident response lifecycle mirrors how a team handles a batting collapse. Preparation is the training and plans laid down before the match. Detection and analysis is the coach recognising the collapse and diagnosing its cause mid-innings. Containment steadies the innings without yet fixing the root fault; eradication corrects the technical flaw causing it; recovery is finishing the innings solidly and confirming, over the next few overs, that the fault has not reappeared.

Preparation happens entirely before any incident occurs: building the tooling, playbooks, and trained team covered throughout this course, along with clear escalation paths and communication templates ready to use under pressure. Detection and analysis is where a SIEM alert or a threat hunt finding, as later lessons cover, is confirmed as a genuine incident and scoped, establishing what happened, what is affected, and how the attacker likely gained access, before any response action is taken.

Analogy🏏Cricket

🎮 Think of it like gaming: preparation is everything you do before the raid even starts — gearing up, memorising the boss patterns, and agreeing who calls the shots, so no one is improvising when the fight begins. Detection and analysis is the pull: you scout the room, confirm the enemy is really there and not a harmless decoy, and read exactly which add spawned and where, before anyone commits an ability. Only once the threat is confirmed and its position mapped does the team engage, because a rushed pull against an unscouted room wipes the whole raid. This reveals why confirming and scoping an incident must precede any response action.

Under the hood, containment, eradication, and recovery form a deliberate sequence rather than a single rushed step. Containment isolates the threat to stop it spreading further, buying time without necessarily fixing anything yet. Eradication removes the actual cause, whether malware, a compromised account, or a vulnerable configuration. Recovery restores affected systems to normal operation and verifies, through monitoring, that the threat is genuinely gone rather than merely quiet and waiting to resurface.

Analogy🏏Cricket

🎵 Think of it like music: containment, eradication, and recovery are three movements that must be played in order, not a single hurried chord. Containment is muting the feedback squealing through the PA — the noise stops instantly, but the faulty cable causing it is still plugged in. Eradication is finding and replacing that faulty cable, removing the actual source of the problem. Recovery is bringing the sound back up and listening carefully through the next few bars to confirm the squeal is genuinely gone rather than lurking quietly at low volume. This reveals why each step targets a distinct goal and cannot be collapsed into one.

text

# NIST 800-61 lifecycle, mapped to earlier module tooling
Preparation        -> playbooks (M4 SOAR), hardened pipelines (M2), IaC baselines (M3)
Detection/Analysis -> SIEM correlation + Sigma alerts (M4), scoping the blast radius
Containment        -> isolate host/account (SOAR approval-gated action)
Eradication        -> remove malware, rotate credentials, patch root cause
Recovery           -> restore service, monitor closely for recurrence
Post-Incident       -> lessons-learned review (Lesson 29)

Best practice treats these four phases as a continuous loop rather than a straight line: lessons from post-incident activity feed directly back into preparation, strengthening the next cycle. Maintain clear, pre-approved decision authority for containment actions so nobody is debating who can pull a server offline while the incident is actively unfolding, and keep detailed timestamped notes throughout every phase, since accurate records are what make later post-incident analysis actually useful rather than a reconstruction from memory.

Analogy🏏Cricket

📷 Think of it like photography: treating the four phases as a loop is how a photographer improves shoot after shoot — reviewing each session's misses feeds directly into how the next one is planned and lit. Pre-approved decision authority is fixing your exposure settings before the moment arrives, so you are not fumbling with dials as the shot disappears. Timestamped notes are the EXIF data automatically stamped on every frame; without that accurate record, reviewing what actually went wrong later becomes guesswork reconstructed from a fading memory. This reveals why documentation and pre-agreed authority make each response cycle stronger than the last.

In the real world, a team that skips straight to eradication without first containing an active intrusion may tip off the attacker or destroy evidence needed later. Following the phases in order, a ransomware incident is first contained by isolating affected hosts from the network, then eradicated by removing the malware and rotating every exposed credential, and only then recovered by restoring from clean backups, with careful monitoring confirming the ransomware does not immediately reappear.

Analogy🏏Cricket

✈️ Think of it like travel: jumping straight to eradication without containing first is like cancelling every booking the instant your card is flagged for fraud — you may tip off the thief and wipe the transaction trail you needed. Handled in order, you first freeze the card so no new charges land (containment), then dispute the fraudulent charges and get a fresh card issued (eradication), and only then rebook your trip on the clean card while watching the statement closely for anything suspicious reappearing (recovery). This reveals why following the phases in sequence protects both the evidence and a clean restoration.

NIST 800-61 defines four phases: preparation, detection/analysis, containment/eradication/recovery, post-incident.
Preparation builds the tooling, playbooks, and team readiness before any incident occurs.
Detection and analysis confirms and scopes an incident before any response action.
Containment, eradication, and recovery are a deliberate sequence, not a single rushed step.
Post-incident lessons feed back into preparation, closing the loop for the next cycle.