Incident Response and IAM — Security+

Digital forensics collects and analyzes evidence so findings hold up under scrutiny (and potentially in court). Preserve chain of custody and hash evidence before and after handling to prove it wasn’t altered. Collect by order of volatility — registers/cache → RAM → disk → backups → archives — because the most fleeting data is lost first when a system is touched or powered down.

Recovery restores systems and data to normal operation after eradication, validating that they’re clean before returning to production. Two objectives drive it: RTO (recovery time objective) sets how fast service must be back, and RPO (recovery point objective) sets how much data loss is tolerable, which dictates backup frequency. DR exercises validate these procedures before a real outage tests them for the first time.

Detection is the second step of the incident response process and the hinge of the whole response — you can’t act on what you never see, and dwell time (how long an attacker goes unnoticed) is often measured in weeks. Mean time to detect (MTTD) is a core SOC metric; detection engineering builds repeatable, testable analytics tied to threat models rather than relying on ad-hoc rules.

Incident response is the disciplined sequence that follows a confirmed incident. The SY0-701 process runs Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned (rooted in the classic NIST SP 800-61 lifecycle, which NIST restructured around CSF 2.0 in 2025’s Revision 3), and the loop’s value is as much in preparation and lessons learned as in the live firefight. Tabletop exercises rehearse the plan so roles, comms, and decisions are practiced before a real incident tests them.

Containment is the fourth step of the SY0-701 incident response process (after preparation, detection, and analysis) and aims to stop the bleeding before eradication. Short-term containment isolates the affected host or segment immediately; long-term containment applies temporary fixes that let business continue while preserving evidence for forensics. Common moves include network isolation, account disablement, and credential rotation — balanced against tipping off an attacker who may then destroy data.

Eradication removes the threat and the attacker’s foothold after containment. It must address root cause and every persistence mechanism — backdoors, scheduled tasks, new accounts, web shells, modified services — not just the obvious malware. Skip it and the attacker simply returns through the same door, which is why rebuilding from known-good images often beats trying to clean a compromised host.

Quarantine isolates a suspect file, host, or account so it can’t cause further harm while it’s investigated — a containment action that deliberately preserves the item as evidence rather than deleting it. EDR products quarantine malicious files automatically and can network-isolate an endpoint with one click, dramatically shrinking blast radius in the critical first minutes.

An event is simply something that happened (a login, a file change); an incident is a confirmed event that violates policy or threatens confidentiality, integrity, or availability. Declaring an incident triggers the formal response process — investigation, communication, containment, and a post-incident review — and often legal or regulatory notification clocks. Accurate classification matters: over-declaring burns out the team, under-declaring lets real attacks run.

Passwords remain the most common “something you know” factor and the weakest link — reused, phished, and guessed. Current NIST guidance favors length over forced complexity, drops mandatory periodic rotation (which pushes users toward weak patterns), and screens new passwords against known-compromised lists. Passwordless authentication (passkeys, FIDO2) is the long-term direction precisely because it removes the shared secret attackers target.

A smart card stores cryptographic credentials in a tamper-resistant chip and is used with a reader, so the private key never leaves the card. Paired with a PIN it delivers true MFA — “something you have” (the card) plus “something you know” (the PIN). It’s standard in government (CAC, PIV) and high-assurance enterprises, and is inherently phishing-resistant because the key can’t be copied off the card.

SSO lets one authentication grant access to many integrated apps, cutting password sprawl and the reuse it breeds. The trade-off is concentration risk: the identity provider becomes a single point of failure and a high-value target, so it must be protected with strong MFA and tight monitoring. SAML and OIDC are the dominant enterprise SSO protocols.

Each CVE ID (e.g., CVE-2017-0144, the EternalBlue flaw behind WannaCry) uniquely names one publicly disclosed vulnerability, giving vendors, scanners, and defenders a common reference. CVE identifies what the flaw is; CVSS scores how severe it is, and feeds like CISA’s KEV catalog flag which CVEs are actively exploited and should jump the patch queue.

CVSS produces a 0–10 base score from exploitability and impact metrics: Critical 9.0–10, High 7.0–8.9, Medium 4.0–6.9, Low 0.1–3.9. The base score is intentionally context-free, so apply Temporal (is an exploit available?) and Environmental (how exposed is this asset?) metrics to your situation. CVSS alone is not a prioritization plan — pair it with exploitation likelihood signals like EPSS and the CISA KEV list.