The alert is real, so what now?
Incident response is the set of steps a team follows once an attack is confirmed. The main steps are to contain it, remove it and recover.
In a real incident people are tired and afraid, and they make mistakes. A team that has agreed the steps beforehand acts calmly and in the right order.
By the end of this lesson
Note
I can put the steps of an incident response in the right order.
Key words
| Word | What it means |
|---|---|
| Incident | an event that harms or could harm the business |
| Contain | stop the problem from spreading |
| Remove | take away everything the attacker left |
| Recover | put the system back to normal use |
| Runbook | a written list of steps for one kind of incident |
| Backup | a saved copy you can restore from |
The cells students fill in are left blank in this preview.
Five steps, always in the same order
First you detect the problem and confirm it is real. Then you contain it, remove it and recover. Last you review what happened.
The order matters. If you remove a leftover before you contain the attack, the attacker may simply put it back.
Number the steps of a runbook
printf '%s\n' detect contain remove recover review | nlShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Containing means cutting the attacker off
Containing stops the harm from growing. You cut the connection of one machine, block an address, or lock an account.
Choose the smallest action that works, because every action costs something. Taking a whole shop offline stops the attacker, and it stops the customers too.
Worked example: ways to contain
| Action | What it stops | What it costs |
|---|---|---|
| Lock one account | Sign-ins as that person | One person cannot work |
| Block one address | Traffic from that source | Little, but the attacker may change address |
| Cut one machine off | Spread to other machines | That machine's service goes down |
| Shut the whole site | Everything | All customers lose the service |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think the first move is to wipe the machine. Wiping ends the attack, but it also destroys the evidence of how it began, so the same hole stays open. Cut the machine off and keep a copy first. Wipe it only after you know what happened.
Remove leftovers, then restore a good copy
Attackers leave ways back in: extra accounts, extra keys, programs that start again by themselves. Remove each one you find, and change the passwords they may have seen.
Then recover from a backup you trust. Check it first. A short fingerprint of a file changes if even one letter changes, so a matching fingerprint shows the copy is the one you saved.
Fingerprint a backup name
printf 'backup-2026-03-01' | sha256sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Sort three steps into order
printf 'step 3\nstep 1\nstep 2\n' | sortShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further
A member of staff reports a lost work laptop. Write a runbook of five lines, one for each step.
Say who must be told at each step, and what you would do about the saved passwords on the laptop.