Unit 02 of 03
Incident Response
Measuring the time between detection and containment in items: how many minutes preparation items cut from the decision chain, how many assets the incident's verification and scope radius miss, the item gap between early and late containment in the same incident, removing persistence in terms of foothold points, supervised recovery along the axis of reinfection risk, lessons learned along the axis of evidence and scope, and notification obligations measured as duration and stakeholder count.
Published Updated
Lessons
- 01 Preparation Counting preparation in items: how twelve preparation items cut the six-step chain from alert to decision from 470 minutes to 182 minutes, pulling the containment moment from 656 to 368 and the items reached from 13 to 9, how the asset inventory's absence alone adds 49 minutes, how the communication tree earns 5.00 minutes per person-hour while forensic collection readiness stays at 0.11, and how pre-approved authority earns 103 minutes a year while cutting 233 legitimate work items. 12 min read
- 02 Identification Measuring scope determination in candidates and minutes: how the seven scope criteria bring between 1 and 19 candidates in a thirty-asset inventory, how the scope step ranges between 3 and 73 minutes, how the log indicator's four candidates in 10 minutes leave the same number of items open as radius two's seventeen candidates in 68 minutes, how the widest criterion cuts legitimate work unnecessarily on thirteen assets, and how two reached collectors cannot be verified by any criterion because they transmit only network flow data. 13 min read
- 03 Containment Calculating the item gap between early and late containment in the same incident: running eight short-term and four long-term actions across seven regimes; early containment stopping at minute 393 with 10 items reached and cutting 1,161 legitimate work items, versus long-term-only containment stopping at minute 765 with 15 items reached and cutting none; the cost of five extra items being 232 legitimate work items per extra item; the same cut rising to 11,687 items with no long-term action; and, in the yearly balance, the early policy preventing 30 extra items against 9,171 legitimate work items. 13 min read
- 04 Eradication Measuring the removal of persistence in terms of footholds: finding 17 of 22 points across nine affected assets in 506 minutes with five discovery methods; three of four configuration hooks going unfound by any method because they were lost on assets taken off the network during containment; across six eradication regimes, the missed-point count dropping from 10 to 0 as total time climbs from 353 minutes to 1,361 minutes; and five missed points producing 8 reinfections in 60 days, with the first on day five. 12 min read
- 05 Recovery Measuring recovery along the axis of reinfection risk: three of seven recovery points being clean, with the newest one nine and a half days back; returning to the clean backup costing 94,715 items of data and 44 manually rebuilt items; rebuilding from scratch giving the same cleanliness for 190 more minutes at a cost of 2,493 lost items; returning to a dirty backup rerunning eradication from scratch and raising total time to 1,347 minutes; and the four-stage supervised restoration bringing the expected points reaching production down from 5.00 to 0.10. 6 min read
- 06 Lessons Learned Measuring the review along the axis of evidence and scope: eleven of sixteen questions being answered with nine record sources, five questions staying unanswered for three distinct reasons, five of twelve improvement items resting directly on a missing record, record-only improvements bringing the answered-question count to 16 for 136 person-hours while shaving 22 minutes off the chain, and preparation and process improvements gaining 55 minutes for 103 person-hours while opening no questions at all. 13 min read
- 07 Communication and Notification Obligations Measuring notification as time and stakeholder count: five of twelve stakeholders being external, the 4,320-minute window of the obligation type that requires notification within a fixed time, the scope estimate dropping from 48,000 to 6,200 without ever settling, early notification over-notifying 14,800 subscribers and producing 46 corrections against staying at 29,967 uninformed subscriber-hours, and late notification exceeding the window by 64,540 minutes across five external stakeholders while producing 1,793,247 subscriber-hours. 12 min read