ISC — Quick Sheet
Incident Response & Monitoring
Read time: ~5 minutes
One-minute revision
- Life cycle: preparation → detection/analysis → containment → eradication → recovery → post-incident review
- Contain before eradicating; preserve evidence and chain of custody
- SIEM correlates logs; IDS alerts, IPS blocks; scanning finds known flaws, pen testing simulates attack
- RTO = how fast back up; RPO = how much data loss is tolerable
- Hot site (immediate) → warm → cold (cheapest, slowest)
- Backups must be tested and kept offline/immutable