Incident response planning

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. When should an organisation write its incident response plan?

A In advance, before an incident happens

B After an incident has already started

2. Which belongs in an incident response plan?

A Only the source code of the software that was attacked

B A list of roles and who to contact, such as the incident manager and IT security lead

3. Which step is about containing an incident?

A Isolating an infected computer from the network to stop malware spreading

B Writing a report about what the team could do better next time

4. Which step is about recovering from an incident?

A Deleting the access logs so the incident is hidden

B Restoring systems and data from a clean backup

5. After an incident, what should a response plan require the team to do?

A Review what happened and update the plan and security controls

B Return to normal and avoid discussing the incident

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1contain(incident)		Arestore(backup); verify(system)
2lessonsLearned(report)		BThe review step of an incident response plan: analyse what happened and update the plan and controls so it is less likely to happen again.
3The plan names who does what and who to contact, so nobody has to guess during an incident.		CThe containment step of an incident response plan: isolate affected systems or accounts quickly so the incident cannot spread further.
4Recovery follows a set order, such as restoring systems from a backup before returning to normal operation.		Droles = {"lead": "Sam", "comms": "Priya"}
5if (breach) { wait(); } // plan: decide who to call later		EThe response is not planned in advance. Roles and contacts must be decided and recorded before an incident, not worked out during one.
6recover(system); closeIncident(); // no report written		FThe incident is closed without reporting or reviewing it. The plan should include reporting and lessons learned so the plan and controls can be improved.

Definitions

incident response plan

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF alert = "malware" THEN _______(server) END IF

incidentLead ← "IT Manager" ______(incidentLead)

isolate(server) _______(server, backup)

IF dataBreach = ____ THEN notify(OAIC) END IF

recover(server) ______(incidentLog) update(incidentPlan)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF alert = TRUE THEN

B shareFiles(infectedDevice)

C restore(cleanBackup)

D END IF

Question 2

A role <- 'Incident Manager'

B duty <- 'delete all the logs'

C contact <- '0400 000 111'

Question 3

A isolate(server)

B removeMalware(server)

C restore(server, infected)

Question 4

A IF breach = TRUE THEN

B notify(manager)

C hide(breach)

D END IF

Question 5

A IF incident = ongoing THEN

B review(response)

C updatePlan(lessons)

D END IF

Answer Key

Incident response planning

Section A: Quick Questions

A — In advance, before an incident happens

B — A list of roles and who to contact, such as the incident manager and IT security lead

A — Isolating an infected computer from the network to stop malware spreading

B — Restoring systems and data from a clean backup

A — Review what happened and update the plan and security controls

Section B: Match the Pairs

contain(incident) → The containment step of an incident response plan: isolate affected systems or accounts quickly so the incident cannot spread further.

lessonsLearned(report) → The review step of an incident response plan: analyse what happened and update the plan and controls so it is less likely to happen again.

The plan names who does what and who to contact, so nobody has to guess during an incident. → roles = {"lead": "Sam", "comms": "Priya"}

Recovery follows a set order, such as restoring systems from a backup before returning to normal operation. → restore(backup); verify(system)

if (breach) { wait(); } // plan: decide who to call later → The response is not planned in advance. Roles and contacts must be decided and recorded before an incident, not worked out during one.

recover(system); closeIncident(); // no report written → The incident is closed without reporting or reviewing it. The plan should include reporting and lessons learned so the plan and controls can be improved.

Section C: Definitions

incident response plan — A plan written in advance that sets out who does what to detect, contain, recover from and learn from a cyber security incident, including roles, contacts, reporting and review.

Section D: Fill in the Blanks

IF alert = "malware" THEN
    isolate(server)
END IF

incidentLead ← "IT Manager"
notify(incidentLead)

isolate(server)
restore(server, backup)

IF dataBreach = TRUE THEN
    notify(OAIC)
END IF

recover(server)
review(incidentLog)
update(incidentPlan)

Section E: Spot the Error

B — Containing an incident means isolating the infected device so the threat cannot spread. Sharing files from it could spread the infection. It should be isolate(infectedDevice).

B — The Incident Manager's duty is to lead the response. Deleting logs destroys evidence needed to investigate the incident. It should be duty <- 'lead the response'.

C — Recovery means restoring systems from a clean backup. Restoring from an infected source would bring the problem straight back. It should be restore(server, cleanBackup).

C — A reporting step in the plan means telling the right parties, such as the OAIC for an eligible data breach. Hiding the breach breaks the law and the plan. It should be report(OAIC).

A — The review and learning stage happens after the incident is resolved, not while it is still ongoing. The condition should be incident = resolved.