🚨 Security Incident Communication

The NIST SP 800-61 incident response lifecycle has four phases. An alert firing is the beginning of Detection and Analysis.

Phase	Key activities
Preparation	Incident response plan, runbooks, tooling, team training — before any incident occurs
Detection & Analysis	Alert triggered → triage → confirm true/false positive → classify severity
Containment, Eradication & Recovery	Stop the spread → remove threat → restore systems to known-good state
Post-Incident Activity	Post-incident review, lessons learned, control improvements

Key vocabulary for this phase:

• IoC (Indicator of Compromise) — artefact or behaviour that suggests a system has been compromised (e.g., unusual outbound traffic, known malicious IP)
• Triage — rapid initial assessment to determine severity and priority of response
• True positive — a genuine incident; false positive — an alert that turns out to be benign
• Severity classification — P1 Critical / P2 High / P3 Medium based on business impact and data sensitivity

Containment = stop the bleeding. It limits damage without necessarily removing the threat — that comes in Eradication.

Step	Goal	Example actions
Short-term containment	Immediately stop further damage	Isolate host from network, block outbound IP, revoke API keys and secrets
Long-term containment	Stabilise environment while eradication is prepared	Apply temporary patches, add firewall rules, increase monitoring
Eradication	Remove the threat entirely	Delete malware, patch the exploited vulnerability, rebuild compromised systems
Recovery	Restore systems to normal operations	Restore from clean backup, validate integrity, return to production

Key vocabulary: "blast radius", "isolation", "containment perimeter", "network segmentation as containment", "revoke credentials".

GDPR Article 33: 72-hour notification to the supervisory authority unless the breach is "unlikely to result in a risk" to individuals.

GDPR obligation	Threshold	Deadline
Art. 33 — Notify supervisory authority	Breach likely to result in risk to individuals	72 hours of becoming aware
Art. 34 — Notify data subjects	Breach likely to result in high risk to individuals	Without undue delay
No notification required	Breach unlikely to result in any risk to individuals	Document internally; justify decision

Key vocabulary:

• Supervisory authority — the national data protection regulator (e.g., ICO in UK, CNIL in France, BfDI in Germany)
• Risk to rights and freedoms — the threshold test; includes financial harm, discrimination, reputational damage
• DPO (Data Protection Officer) — mandatory role in some organisations; advises on GDPR but does not exempt from reporting obligations
• Controller vs. processor obligations — processors must notify the controller "without undue delay"; controllers notify the supervisory authority

STIX (Structured Threat Information eXpression) is the standard language for describing and sharing cyber threat intelligence.

Standard	Purpose
STIX	Structured format for describing threat intelligence objects: IoCs, TTPs, threat actors, campaigns, vulnerabilities
TAXII	Trusted Automated eXchange of Intelligence Information — the transport protocol for distributing STIX bundles
IoC feed	A stream of indicators (IPs, domains, file hashes) that defenders can ingest into SIEMs and firewalls
ISAC	Information Sharing and Analysis Centre — sector-specific threat intel sharing groups (FS-ISAC for finance, H-ISAC for healthcare)

Why IoC sharing matters: If one organisation detects a new malware hash or attacker IP, sharing it via STIX/TAXII allows other organisations to block the same threat before they are hit. This is the foundation of collective defence.

Key vocabulary: "threat intelligence sharing", "IoC feed ingestion", "TTP (Tactics, Techniques, and Procedures)", "ISAC membership".

Blameless post-mortem culture (pioneered by Google SRE) = people don't hide information out of fear of punishment, leading to better systemic learning and fewer repeated incidents.

Approach	Focus	Outcome
Blame-focused	"Who made the mistake?"	People hide errors; root causes stay hidden; incidents repeat
Blameless	"What systemic conditions made the mistake likely?"	Root causes exposed; processes improved; incidents reduce over time

Key PIR elements:

• Timeline reconstruction — detailed chronology of what happened and when
• Contributing factors — systemic conditions that enabled the incident (unclear runbooks, insufficient monitoring, missing access controls)
• 5-whys analysis — asking "why?" iteratively to find the root cause beneath the immediate cause
• Action items — concrete follow-up tasks with owners and deadlines
• Human factors — cognitive load, unclear alerts, on-call fatigue — systemic, not personal failures

Initially, monitoring is important, but rapid action is needed. Blocking the IP address, while potentially effective in the short term, doesn't address the underlying cause. David should focus on understanding the nature and volume of requests to assess the severity and scope of the potential compromise. A proactive investigation is crucial for containing the damage.

David's primary focus is containment. Isolating the server is the immediate step to stop the spread of the attack and minimize data loss – this aligns with the core principle of incident response. Notifying users and password resets are important *later* steps, but not the first priority for containing the breach. A forensic analysis is valuable, but secondary to preventing further damage.

While testing and deployment are important aspects of PRs, security communication demands specific details about the vulnerability. Including the CVE ID and affected user base allows for accurate tracking, risk assessment, and remediation efforts. Simply stating 'bypass' is insufficient – it lacks critical context needed to understand the severity.

The 403 Forbidden status code specifically indicates an authorization failure. The message confirms that the user lacked the necessary permissions to access the requested resource – this is a clear sign of a potential security issue or misconfiguration requiring investigation. A system error (500) or API unavailability (503) would have different implications.

The lead engineer's statement indicates a potential active attack. Escalating to the SOC is the correct initial response as they have dedicated resources (tools & expertise) for immediate threat analysis and containment. While documenting and analyzing IPs are important later steps, immediate escalation is crucial in this scenario.

While patching the vulnerability is important, the potential for past breaches necessitates a focused investigation. Examining logs is *critical* to determine if sensitive data was accessed or exfiltrated during the exploitation window. Password resets are a reactive measure and might not address the root cause – the logs hold the key.