Please enable JavaScript.
Coggle requires JavaScript to display documents.
🚨 3️⃣ NCA ECC DOMAIN 3 — CYBERSECURITY RESILIENCE - Coggle Diagram
🚨 3️⃣ NCA ECC DOMAIN 3 — CYBERSECURITY RESILIENCE
3.1️⃣ Incident Response Management 🚨
3.1.1 Incident Response Policy 📜
Define incident types
Define response procedures
Define roles and responsibilities
Communication requirements
Approval and review process
3.1.2 Incident Response Team (IRT) 👥
Incident Response Manager
SOC Analysts
Security Engineers
System Administrators
Network Engineers
Digital Forensics Team
Management Representatives
3.1.3 Incident Classification 📊
Malware Infection 🦠
Phishing Attack 🎣
Unauthorized Access 🔑
Data Breach 💾
Ransomware Attack 🔒
Insider Threat 👤
Network Intrusion 🌐
3.1.4 Incident Severity Rating ⚠️
Critical 🔴
National impact / critical infrastructure impact
High 🟠
Major business disruption
Medium 🟡
Limited impact
Low 🟢
Minor security event
3.2️⃣ Incident Detection & Analysis 🔍
3.2.1 Security Monitoring 📊
SIEM Monitoring
ELK Stack
Splunk
Microsoft Sentinel
Endpoint Monitoring
OSSEC
Wazuh
EDR Solutions
Network Monitoring
IDS
IPS
Firewall Logs
Network Traffic Analysis
3.2.2 Alert Investigation 🔎
Validate Alert
Collect Evidence
Identify Attack Source
Determine Attack Method
Calculate Impact
3.2.3 Threat Intelligence Integration 🌍
IOC Collection
IP Addresses
Domains
Hashes
Malware Signatures
Threat Feeds
Threat Actor Analysis
3.2.4 MITRE ATT&CK Mapping 🎯
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Impact
3.3️⃣ Incident Response Process 🔄
3.3.1 Preparation Phase 📝
Create IR Plan
Define Tools
Train Response Team
Build Communication Plan
Conduct Exercises
3.3.2 Identification Phase 🔍
Detect Suspicious Activity
Analyze Logs
Confirm Incident
Assign Severity
3.3.3 Containment Phase 🛑
Short-Term Containment
Isolate Host
Block IP
Disable Account
Long-Term Containment
Network Segmentation
Patch Systems
Remove Persistence
3.3.4 Eradication Phase 🧹
Remove Malware
Delete Backdoors
Reset Credentials
Fix Vulnerabilities
Harden Systems
3.3.5 Recovery Phase 🔄
Restore Services
Restore Backups
Monitor Systems
Validate Security
Return Operations
3.3.6 Lessons Learned 📚
Root Cause Analysis
Update Security Controls
Improve Detection Rules
Update Procedures
Management Report
3.4️⃣ Digital Forensics 🔬
3.4.1 Evidence Collection
Disk Images
Memory Capture
Log Collection
Network Capture
3.4.2 Forensic Analysis
Timeline Analysis
Malware Analysis
User Activity Analysis
Attack Reconstruction
Tools 🧰
Volatility 3
Autopsy
FTK
Wireshark
Plaso
3.5️⃣ Business Continuity & Disaster Recovery 🏢
Backup Management 💾
Backup Policy
Backup Testing
Offline Backup
Recovery Testing
Disaster Recovery Plan
Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Emergency Procedures
Business Impact Analysis
Critical Services
Dependencies
Recovery Priorities
🎯 NCA ECC Domain 3 Implementation Workflow
1️⃣ Prepare Incident Response Capability 🚨
2️⃣ Monitor Security Events 📊
3️⃣ Detect Threats 🔍
4️⃣ Analyze Impact ⚠️
5️⃣ Contain Attack 🛑
6️⃣ Remove Threat 🧹
7️⃣ Recover Operations 🔄
8️⃣ Improve Security Controls 📈