incident-response

# Incident Response Skill ## Purpose This skill establishes comprehensive procedures for detecting, analyzing, containing, eradicating, and recovering from security incidents affecting the CIA platform. It implements systematic incident management aligned with NIST SP 800-61r2, ISO 27035, and Hack23 ISMS Incident Response Plan with measurable response times and transparent communication. ## When to Use This Skill Apply this skill when: - ✅ Detecting security alerts or suspicious activity - ✅ Responding to security breaches or data exposure - ✅ Managing vulnerability exploitation incidents - ✅ Coordinating response to service disruptions - ✅ Handling supply chain security incidents - ✅ Meeting GDPR 72-hour breach notification requirements - ✅ Conducting post-incident analysis and lessons learned - ✅ Updating incident response playbooks Do NOT use for: - ❌ Routine maintenance or planned downtime - ❌ Non-security operational issues - ❌ Performance degradation without security implications ## Decision Tree ```mermaid %%{ init: { 'theme': 'base', 'themeVariables': { 'primaryColor': '#D32F2F', 'primaryTextColor': '#fff', 'lineColor': '#D32F2F', 'secondaryColor': '#FF9800', 'tertiaryColor': '#4CAF50' } } }%% flowchart TD DETECT["🔍 Incident Detected"] --> VALIDATE{"✅ Confirmed<br/>Security Incident?"} VALIDATE -->|YES| CLASSIFY{"🏷️ Classify Severity"} VALIDATE -->|NO| FALSE["📋 False Positive<br/>Document & Close"] CLASSIFY -->|🔴 Critical<br/>€10K+ daily loss| S1["🔴 S1: Critical Response<br/>RTO: 30 min<br/>All Stakeholders"] CLASSIFY -->|🟠 High<br/>€5-10K daily loss| S2["🟠 S2: High Response<br/>RTO: 1 hour<br/>Key Stakeholders"] CLASSIFY -->|🟡 Medium<br/>€1-5K daily loss| S3["🟡 S3: Medium Response<br/>RTO: 4 hours<br/>Internal Only"] CLASSIFY -->|🟢 Low<br/><€1K daily loss| S4["🟢 S4: Low Response<br/>RTO: 24 hours<br/>Documentation"] S1 --> ACTIVATE["🚨 Activate Response Team<br/>CEO + Specialists"] S2 --> ACTIVATE S3 --> ACTIVATE S4 --> ACTIVATE ACTIVATE --> CONTAIN["🛡️ Containment<br/>Isolate & Preserve"] CONTAIN --> INVESTIGATE["🔬 Investigation<br/>Root Cause Analysis"] INVESTIGATE --> REMEDIATE["🔧 Remediation<br/>Fix & Restore"] REMEDIATE --> VALIDATE_FIX{"✅ Validated?"} VALIDATE_FIX -->|NO| REMEDIATE VALIDATE_FIX -->|YES| NOTIFY{"📢 External<br/>Notification<br/>Required?"} NOTIFY -->|YES - GDPR| GDPR["📢 GDPR Notification<br/>72-hour deadline"] NOTIFY -->|YES - NIS2| NIS2["📢 NIS2 Notification<br/>24-hour initial"] NOTIFY -->|YES - Customers| CUSTOMER["📢 Customer Notice<br/>Per SLA"] NOTIFY -->|NO| DOCUMENT GDPR --> DOCUMENT["📝 Incident Report"] NIS2 --> DOCUMENT CUSTOMER --> DOCUMENT DOCUMENT --> LESSONS["📈 Lessons Learned<br/>Process Improvement"] LESSONS --> CLOSE["✅ Close Incident<br/>Archive Evidence"] CLOSE --> MONITOR["🔄 Continuous Monitoring"] style DETECT fill:#2196F3,color:#fff style S1 fill:#D32F2F,color:#fff style S2 fill:#FF9800,color:#fff style S3 fill:#FFC107,color:#000 style S4 fill:#4CAF50,color:#fff style CONTAIN fill:#7B1FA2,color:#fff style INVESTIGATE fill:#1565C0,color:#fff style REMEDIATE fill:#FF9800,color:#fff style CLOSE fill:#4CAF50,color:#fff ``` ## Incident Severity Classification ### Severity Matrix | **Severity** | **Financial Impact** | **Operational Impact** | **RTO** | **Escalation** | |--------------|---------------------|------------------------|---------|----------------| | **🔴 S1: Critical** | €10K+ daily loss | Complete outage | **30 minutes** | CEO + External Consultant | | **🟠 S2: High** | €5-10K daily loss | Major degradation | **1 hour** | CEO + Insurance Provider | | **🟡 S3: Medium** | €1-5K daily loss | Partial impact | **4 hours** | CEO Investigation | | **🟢 S4: Low** | <€1K daily loss | Minor inconvenience | **24 hours** | CEO Scheduled Review | ### Incident Classification Examples **🔴 S1: Critical Incidents** - Ransomware infection affecting production systems - Active data breach with PII exposure - Complete service outage affecting all users - Successful credential theft with admin access - Criminal liability (GDPR Article 83 violations) **🟠 S2: High Incidents** - Exploitation of critical vulnerability (CVSS 9.0+) - Partial data exposure (limited user data) - Major service degradation (>50% users affected) - Unauthorized access to sensitive systems - Regulatory investigation triggered **🟡 S3: Medium Incidents** - Attempted exploitation (blocked by controls) - Security misconfigurations discovered - Malware detected and quarantined - Moderate service impact (<50% users) - Minor compliance violations **🟢 S4: Low Incidents** - Failed login attempts (below threshold) - Security scan false positives - Minor policy violations - Suspicious activity with no impact - Documentation issues ## Incident Response Lifecycle ### Phase 1: Preparation **Pre-Incident Readiness:** ```yaml Incident_Response_Team: - CEO: James Pether Sörling (Incident Commander) - Security Lead: Primary responder - Development Lead: Technical remediation - External Consultant: On-call security expert - Legal Counsel: GDPR/regulatory compliance - Insurance Provider: Cyber insurance liaison Tools_and_Resources: - AWS Detective: Log analysis and investigation - AWS Security Hub: Centralized security findings - AWS GuardDuty: Threat detection - GitHub Security: Repository security monitoring - CloudWatch Logs Insights: Query and analysis - Incident Response Playbooks: Scenario-specific procedures Communication_Channels: - Primary: CEO email (james.sorling@hack23.com) - Secondary: GitHub Issues (private security issues) - Emergency: AWS Support (Enterprise plan) - External: External Stakeholder Registry contacts - Documentation: ISMS-PUBLIC repository updates Evidence_Preservation: - AWS CloudTrail: 90-day retention - Application Logs: CloudWatch 30-day retention - Database Audit Logs: 90-day retention - Network Flow Logs: VPC Flow Logs 7-day retention - Backup Snapshots: Automated daily backups ``` **Preparation Checklist:** - [ ] **Incident Response Plan:** Reviewed and updated quarterly - [ ] **Contact List:** Current and tested (External Stakeholder Registry) - [ ] **Playbooks:** Scenario-specific procedures documented - [ ] **Tools:** AWS security services enabled and monitored - [ ] **Training:** Annual tabletop exercises conducted - [ ] **Backups:** Verified and tested monthly - [ ] **Insurance:** Cyber insurance policy active and adequate - [ ] **Legal:** Retainer with legal counsel for GDPR compliance ### Phase 2: Detection and Analysis **Detection Sources:** ```mermaid flowchart LR subgraph "🔍 Automated Detection" GUARD[AWS GuardDuty<br/>Threat Detection] SECHUB[AWS Security Hub<br/>Findings Aggregation] CODEQL[CodeQL<br/>Code Scanning] DEPEND[Dependabot<br/>Vulnerability Alerts] end subgraph "👁️ Manual Detection" USER[User Report<br/>Security Concern] AUDIT[Security Audit<br/>Findings] RESEARCH[Security Researcher<br/>Disclosure] MONITOR[System Monitoring<br/>Anomalies] end subgraph "🎯 Incident Triage" VALIDATE[Validate Incident] CLASSIFY[Classify Severity] ASSIGN[Assign Response Team] end GUARD --> VALIDATE SECHUB --> VALIDATE CODEQL --> VALIDATE DEPEND --> VALIDATE USER --> VALIDATE AUDIT --> VALIDATE RESEARCH --> VALIDATE MONITOR --> VALIDATE VALIDATE --> CLASSIFY CLASSIFY --> ASSIGN style VALIDATE fill:#FF9800,color:#fff style CLASSIFY fill:#D32F2F,color:#fff style ASSIGN fill:#1565C0,color:#fff ``` **Initial Assessment Checklist:** - [ ] **Incident Confirmed:** Validate security incident vs. false positive - [ ] **Scope Identified:** Affected systems, data, and users documented - [ ] **Timeline Established:** Initial detection and estimated start time - [ ] **Severity Classified:** Using severity matrix (S1-S4) - [ ] **Evidence Preserved:** Logs, snapshots, and artifacts collected - [ ] **Team Notified:** Response team activated per severity level - [ ] **Stakeholders Informed:** CEO notified within RTO - [ ] **Communication Plan:** Notification requirements assessed **Analysis Activities:** ```bash # 1. Collect AWS CloudTrail logs aws cloudtrail lookup-events \ --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \ --start-time 2024-01-15T00:00:00Z \ --end-time 2024-01-16T00:00:00Z \ --max-results 100 \ > incident-cloudtrail-logs.json # 2. Query CloudWatch Logs aws logs filter-log-events \ --log-group-name /aws/lambda/cia-production \ --start-time $(date -d '24 hours ago' +%s)000 \ --filter-pattern "ERROR" \ > incident-application-logs.txt # 3. Check AWS GuardDuty findings aws guardduty list-findings \ --detector-id YOUR_DETECTOR_ID \ --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \ --sort-criteria '{"AttributeName":"updatedAt","OrderBy":"DESC"}' \ > incident-guardduty-findings.json # 4. Review AWS Security Hub findings aws securityhub get-findings \ --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}' \ --max-results 100 \ > incident-securityhub-findings.json # 5. Analyze access patterns aws cloudtrail lookup-events \ --lookup-attributes AttributeKey=Username,AttributeValue=SUSPECTED_USER \ --start-time 2024-01-15T00:00:00Z \ > incident-user-activity.json # 6. Create evidence package tar -czf incident-evidence-$(date +%Y%m%d-%H%M%S).tar.gz \ incident-*.json incident-*.txt ``` ### Phase 3: Containment **Short-Term Containment:** ```yaml Immediate_Actions: Network_Isolation: - Action: Isolate affected systems from network - Method: AWS Security Group rule changes - Command: | aws ec2 revoke-security-group-ingress \ --group-id sg-AFFECTED \ --protocol all \ --cidr 0.0.0.0/0 Access_Revocation: - Action: Disable compromised user accounts - Method: AWS IAM policy detachment - Command: | aws iam delete-login-profile \ --user-name COMPROMISED_USER aws iam list-access-keys \ --user-name COMPROMISED_USER | \ jq -r '.AccessKeyMetadata[].AccessKeyId' | \ xargs -I {} aws iam delete-access-key \ --user-name COMPROMISED_USER \ --access-key-id {} Session_Termination: - Action: Invalidate active sessions - Method: AWS IAM role trust policy update - Command: | aws iam update-assume-role-policy \ --role-name AFFECTED_ROLE \ --policy-document file://deny-all-policy.json Snapshot_Creation: - Action: Preserve current state for forensics - Method: EBS snapshot, RDS snapshot, S3 versioning - Command: | aws ec2 create-snapshot \ --volume-id vol-AFFECTED \ --description "Incident forensic snapshot $(date)" aws rds create-db-snapshot \ --db-snapshot-identifier incident-snapshot-$(date +%Y%m%d) \ --db-instance-identifier cia-production ``` **Long-Term Containment:** ```yaml Sustained_Protection: System_Patching: - Action: Apply security patches to affected systems - Priority: Critical vulnerabilities first - Validation: Test in staging before production Password_Rotation: - Action: Force password reset for all affected users - Method: AWS Cognito password reset enforcement - Scope: All users if credential exposure suspected Certificate_Revocation: - Action: Revoke and reissue compromised certificates - Method: AWS Certificate Manager - Timeline: Immediate for compromised, planned for rotation WAF_Rules: - Action: Deploy AWS WAF rules to block attack patterns - Patterns: IP blocking, SQL injection, XSS prevention - Review: Daily review during incident response Enhanced_Monitoring: - Action: Increase logging verbosity and alerting - Tools: CloudWatch alarms, GuardDuty sensitivity - Duration: Maintain until incident closed + 30 days ``` ### Phase 4: Eradication **Root Cause Elimination:** ```yaml Malware_Removal: - Identify all infected systems (AWS Systems Manager inventory) - Terminate compromised EC2 instances - Deploy clean AMI from known-good backup - Scan file systems with AWS Inspector - Verify integrity with AWS CloudWatch Logs Insights Vulnerability_Patching: - Apply security patches addressing root cause - Update dependencies (Dependabot PRs) - Fix configuration weaknesses (AWS Config remediation) - Implement compensating controls if patch unavailable Account_Cleanup: - Remove unauthorized user accounts (AWS IAM) - Delete rogue resources (EC2, Lambda, S3) - Audit and correct permission escalations - Review and revoke suspicious API keys Configuration_Hardening: - Enable AWS GuardDuty if disabled - Enforce MFA for all IAM users - Implement least privilege IAM policies - Enable encryption at rest (S3, EBS, RDS) - Enable VPC Flow Logs for network monitoring ``` **Eradication Checklist:** - [ ] **Root Cause Identified:** Technical analysis complete - [ ] **Vulnerability Fixed:** Patch applied or workaround implemented - [ ] **Malware Removed:** All infected systems cleaned or replaced - [ ] **Accounts Secured:** Unauthorized access revoked - [ ] **Configuration Hardened:** Security controls strengthened - [ ] **Validation Testing:** Security scans confirm clean state - [ ] **Documentation Updated:** Changes recorded in change log ### Phase 5: Recovery