Security Operations — Incident Response and Disaster Recovery

Incident Response

PICERL

1. Preparation: policy, tools, drills
2. Identification: detect and size the event
3. Containment: stop spread
4. Eradication: remove the cause
5. Recovery: return to service
6. Lessons learned: what to change

---

Digital Forensics

Collect, analyze, preserve.

Integrity: hash at collection (SHA-256). Detect later change.

Chain of custody: who held it, when, in what state — a continuous record.

Order of volatility:

• Volatile first: RAM, live connections, running processes
• Then non-volatile: disks, logs

---

SIEM

Central collection, analysis, and correlation of security events.

Functions:

• Logs from firewalls, IDS, OS, databases
• Near-real-time anomaly detection
• Alerts
• Compliance reports

Examples of products: Splunk, IBM QRadar, Microsoft Sentinel — names, not a buying list.

---

BCP and DRP

BCP: keep the business running through a disaster.

DRP: restore IT systems and infrastructure.

Metrics

RPO: maximum acceptable data loss.

$$RPO = 4 \text{hours} \to \text{back up at least every} 4 \text{hours}$$

RTO: maximum acceptable time to restore.

$$RTO = 2 \text{hours} \to \text{the system must be up within} 2 \text{hours}$$

Recovery sites

Strategy	Cost	RTO
Cold site	Low	Days to weeks
Warm site	Medium	Hours to days
Hot site	High	Minutes to hours
Cloud DR	Flexible	Can be minutes

---

Key Concept Cards

Incident response ★★★★★
: Prepare → identify → contain → eradicate → recover → lessons. Containment first.

RPO vs RTO ★★★★★
: RPO sets backup frequency. RTO sets the DR strategy.

Hot / warm / cold ★★★★☆
: Hot = fast and expensive. Cold = slow and cheap. Match RPO/RTO.

---

Practice Quiz

Q1. Ransomware is detected. What is the first IR action?

Containment. Isolate infected hosts so the malware cannot move laterally. Forensics matter, but spread comes first.

Q2. RPO = 1 hour, RTO = 4 hours. What backup and recovery fit?

Backup or replicate at least hourly (RPO). Restore within 4 hours (RTO). Warm site or cloud DR can hit that. A cold site that takes days cannot.