Security Incident Communication | Security Lab Exercises

1 / 5

A security monitoring alert fires: "Unusual outbound traffic detected — possible data exfiltration."

Which phase of the NIST incident response lifecycle is the team currently in?

The NIST SP 800-61 incident response lifecycle has four phases. An alert firing is the beginning of Detection and Analysis.

Phase	Key activities
Preparation	Incident response plan, runbooks, tooling, team training — before any incident occurs
Detection & Analysis	Alert triggered → triage → confirm true/false positive → classify severity
Containment, Eradication & Recovery	Stop the spread → remove threat → restore systems to known-good state
Post-Incident Activity	Post-incident review, lessons learned, control improvements

Key vocabulary for this phase:

IoC (Indicator of Compromise) — artefact or behaviour that suggests a system has been compromised (e.g., unusual outbound traffic, known malicious IP)
Triage — rapid initial assessment to determine severity and priority of response
True positive — a genuine incident; false positive — an alert that turns out to be benign
Severity classification — P1 Critical / P2 High / P3 Medium based on business impact and data sensitivity

2 / 5

The incident commander says: "We need to contain the breach before we proceed to eradication."

What does containment mean in incident response terms?

Containment = stop the bleeding. It limits damage without necessarily removing the threat — that comes in Eradication.

Step	Goal	Example actions
Short-term containment	Immediately stop further damage	Isolate host from network, block outbound IP, revoke API keys and secrets
Long-term containment	Stabilise environment while eradication is prepared	Apply temporary patches, add firewall rules, increase monitoring
Eradication	Remove the threat entirely	Delete malware, patch the exploited vulnerability, rebuild compromised systems
Recovery	Restore systems to normal operations	Restore from clean backup, validate integrity, return to production

Key vocabulary: "blast radius", "isolation", "containment perimeter", "network segmentation as containment", "revoke credentials".

3 / 5

Under GDPR, a personal data breach must be reported to the supervisory authority. Which statement about the reporting obligation is correct?

GDPR Article 33: 72-hour notification to the supervisory authority unless the breach is "unlikely to result in a risk" to individuals.

GDPR obligation	Threshold	Deadline
Art. 33 — Notify supervisory authority	Breach likely to result in risk to individuals	72 hours of becoming aware
Art. 34 — Notify data subjects	Breach likely to result in high risk to individuals	Without undue delay
No notification required	Breach unlikely to result in any risk to individuals	Document internally; justify decision

Key vocabulary:

Supervisory authority — the national data protection regulator (e.g., ICO in UK, CNIL in France, BfDI in Germany)
Risk to rights and freedoms — the threshold test; includes financial harm, discrimination, reputational damage
DPO (Data Protection Officer) — mandatory role in some organisations; advises on GDPR but does not exempt from reporting obligations
Controller vs. processor obligations — processors must notify the controller "without undue delay"; controllers notify the supervisory authority

4 / 5

The security operations team reports: "Indicators of Compromise (IoCs) have been shared with our partners via STIX format."

What is STIX and why is IoC sharing important?

STIX (Structured Threat Information eXpression) is the standard language for describing and sharing cyber threat intelligence.

Standard	Purpose
STIX	Structured format for describing threat intelligence objects: IoCs, TTPs, threat actors, campaigns, vulnerabilities
TAXII	Trusted Automated eXchange of Intelligence Information — the transport protocol for distributing STIX bundles
IoC feed	A stream of indicators (IPs, domains, file hashes) that defenders can ingest into SIEMs and firewalls
ISAC	Information Sharing and Analysis Centre — sector-specific threat intel sharing groups (FS-ISAC for finance, H-ISAC for healthcare)

Why IoC sharing matters: If one organisation detects a new malware hash or attacker IP, sharing it via STIX/TAXII allows other organisations to block the same threat before they are hit. This is the foundation of collective defence.

Key vocabulary: "threat intelligence sharing", "IoC feed ingestion", "TTP (Tactics, Techniques, and Procedures)", "ISAC membership".

5 / 5

After the incident is resolved, the team conducts a Post-Incident Review (PIR). The team lead says it will be a "blameless post-incident review".

What distinguishes a blameless PIR from a blame-focused investigation?

Blameless post-mortem culture (pioneered by Google SRE) = people don't hide information out of fear of punishment, leading to better systemic learning and fewer repeated incidents.

Approach	Focus	Outcome
Blame-focused	"Who made the mistake?"	People hide errors; root causes stay hidden; incidents repeat
Blameless	"What systemic conditions made the mistake likely?"	Root causes exposed; processes improved; incidents reduce over time

Key PIR elements:

Timeline reconstruction — detailed chronology of what happened and when
Contributing factors — systemic conditions that enabled the incident (unclear runbooks, insufficient monitoring, missing access controls)
5-whys analysis — asking "why?" iteratively to find the root cause beneath the immediate cause
Action items — concrete follow-up tasks with owners and deadlines
Human factors — cognitive load, unclear alerts, on-call fatigue — systemic, not personal failures