Dictionary · Defensive Security
Incident Response
Operations · Intermediate
The organized process for handling a confirmed or suspected security incident: prepare, identify, contain, eradicate, recover, and learn.
It is a practiced sequence, not improvisation during the worst hour. Containment stops the spread, eradication removes the cause, and recovery returns the business with evidence preserved.
Example: The team isolates a host, resets the affected accounts, restores clean data, and writes down what the alert missed.
Common misconception
- Reimaging immediately can destroy evidence you needed. The plan should say when to preserve and when to recover.