Incident response is the structured handling of a live security incident. It is a rehearsed sequence of decisions about containment, evidence, communication and remediation. The organisations that come out of a breach intact are almost always the ones that rehearsed the sequence before they needed it.
The phases
- Preparation: named roles, tested runbooks, retained specialists on standby.
- Detection and analysis: confirming what is happening, and what is at risk.
- Containment: cutting off the intruder without destroying the evidence.
- Eradication and recovery: removing the cause, restoring service, watching for return.
- Lessons learned: a written record of what changed as a result.
Where forensics fits in
Forensic evidence work runs in parallel with containment, not after it. The examiner takes images and logs before rebuilds, so the organisation can answer regulators, insurers and any claimants with confidence.