Full Report
Incident response is a lot like a choose your own adventure exercise. We cover the ground rules and talk about some incidents we’ve helped partners with.
Analysis Summary
# Best Practices: Incident Response Decision-Making
## Overview
These practices address the critical initial phase of Incident Response (IR). By treating IR as a "choose your own adventure" exercise, these guidelines help defenders ask the right questions to determine the scope, severity, and legal requirements of an incident before taking action.
## Key Recommendations
### Immediate Actions
1. **Verify Compliance & Legal Frameworks:** Before touching a system, determine if the organization has cyber insurance or is under regulatory oversight (GDPR, HIPAA, etc.) that dictates specific evidence-handling procedures.
2. **Define Incident Severity:** Distinguish between a low-level "foothold" (e.g., persistent malware on one workstation) and a high-level threat like Cobalt Strike running on a server.
3. **Establish Scope:** Identify if the threat is a single-host infection, a "hands-on" actor moving laterally, or a supply-chain compromise affecting multiple clients/tenants.
4. **Law Enforcement Protocol:** If law enforcement requests hardware, do not surrender it without obtaining:
* Indicators of Compromise (IoCs) found.
* Specific timestamps of the activity.
* IP addresses to block.
* Technical point of contact for follow-up.
### Short-term Improvements (1-3 months)
1. **Develop an IR Playbook:** Create a "Choose Your Own Adventure" style flowchart that guides junior analysts through the questioning process during an alert.
2. **External Resource Mapping:** Identify and vet third-party IR firms or insurance-approved vendors so you aren't searching for support during an active Cobalt Strike event.
3. **Active Remediation Deployment:** Implement tools that allow for "Active Remediation" (like Managed EDR) to automate the isolation of compromised hosts.
### Long-term Strategy (3+ months)
1. **Managed ITDR Integration:** Transition to Identity Threat Detection and Response (ITDR) to gain chronological insights into how attackers move through the environment.
2. **Tabletop Exercises:** Conduct mock IR simulations where the scenario changes based on the "choices" made by the security team to build muscle memory for asking clarifying questions.
## Implementation Guidance
### For Small Organizations
- **Prioritize Essentials:** Focus on having a basic list of emergency contacts (Insurance, MSP, Law Enforcement).
- **Tooling:** Use managed services (Managed Defender/EDR) to offset the lack of a 24/7 internal SOC.
### For Medium Organizations
- **Define Escalation Paths:** Clearly document when an incident moves from "internal remediation" to "external forensic support."
- **Standardize Questions:** Provide helpdesk staff with a checklist of questions to ask users when a breach is suspected.
### For Large Enterprises
- **Multi-Tenant Scoping:** For MSPs/Enterprises with multiple business units, ensure you have visibility into whether an attack is localized or widespread across the entire infrastructure.
- **Timeline Automation:** Use tools that generate incident report timelines to provide clear, chronological insights for stakeholders.
## Configuration Examples
*While specific CLI code was not provided in the article, the following technical posture is recommended:*
- **Host Isolation:** Configure EDR to allow for one-click isolation of a workstation (X) when law enforcement identifies it as a source of cybercrime.
- **Logging:** Ensure logging levels are sufficient to capture "footholds" and lateral movement (Event ID 4624 for logins, Process Creation tracking).
## Compliance Alignment
- **NIST SP 800-61:** Aligns with the *Preparation* and *Detection & Analysis* phases of the IR life cycle.
- **CIS Controls:** Supports Control 17 (Incident Response Management).
- **ISO/IEC 27035:** Principles for information security incident management.
## Common Pitfalls to Avoid
- **Panic Reactions:** Rolling over and ignoring the alert OR acting too quickly without understanding the scope (running onto the battlefield without a sword).
- **Lack of Dialogue:** Handing over hardware to authorities or wiping a machine without collecting IoCs first.
- **Ignoring Insurance Rules:** Performing remediation that might void a cyber insurance claim by destroying evidence.
## Resources
- **Huntress Managed EDR:** [https://www.huntress.com/platform/managed-edr](https://www.huntress.com/platform/managed-edr)
- **Incident Response Planning Basics:** [https://www.huntress.com/blog/incident-response-planning-basics](https://www.huntress.com/blog/incident-response-planning-basics)
- **Persistence/Foothold Guide:** [https://www.huntress.com/defenders-handbook/persistence-in-cybersecurity](https://www.huntress.com/defenders-handbook/persistence-in-cybersecurity)