Please enable JavaScript.
Coggle requires JavaScript to display documents.
🚨 8️⃣ NCA ECC D 8 — CYBERSECURITY INCIDENT MANAGEMENT - Coggle Diagram
🚨 8️⃣ NCA ECC D 8 — CYBERSECURITY INCIDENT MANAGEMENT
8.1️⃣ Incident Management Governance 🏛️
8.1.1 Incident Response Policy 📜
Incident definition
Incident classification
Response procedures
Escalation requirements
Approval process
8.1.2 Incident Response Framework 🔄
Preparation
Detection
Analysis
Containment
Eradication
Recovery
Lessons Learned
8.1.3 Incident Roles & Responsibilities 👥
CISO
SOC Manager
Incident Commander
Security Analyst
System Administrator
Network Engineer
Management Team
8.2️⃣ Security Event Detection 🔍
8.2.1 Event Collection 📥
Windows Event Logs
Linux Logs
Firewall Logs
IDS/IPS Logs
Application Logs
Cloud Logs
Endpoint Logs
8.2.2 SIEM Monitoring 📊
Log Aggregation
Correlation Rules
Dashboards
Alerts
Threat Hunting
8.2.3 Detection Technologies 🛡️
SIEM
ELK Stack
Splunk
Microsoft Sentinel
EDR
IDS
IPS
Network Detection Response (NDR)
8.2.4 Threat Intelligence 🌍
IOC Detection
Malware Intelligence
Threat Actor Tracking
Attack Campaign Analysis
8.3️⃣ Incident Analysis 🔬
8.3.1 Alert Validation ✅
False Positive Identification
True Positive Confirmation
Severity Assignment
8.3.2 Investigation Process 🕵️
Timeline Creation
Log Analysis
User Activity Review
Network Analysis
Malware Analysis
8.3.3 Attack Mapping 🎯
MITRE ATT&CK Techniques
Tactics Identification
Attack Chain Analysis
Threat Actor Profiling
8.3.4 Evidence Management 📂
Evidence Collection
Evidence Preservation
Chain of Custody
Forensic Documentation
8.4️⃣ Incident Containment 🛑
8.4.1 Short-Term Containment
Isolate Endpoint
Block Malicious IP
Disable Account
Stop Malicious Process
8.4.2 Long-Term Containment
Patch Vulnerabilities
Network Segmentation
Remove Persistence
Improve Controls
8.4.3 Communication Management 📢
Internal Notification
Management Reporting
Regulatory Reporting
Stakeholder Updates
8.5️⃣ Incident Eradication 🧹
Malware Removal 🦠
Antivirus Scan
EDR Investigation
Malware Cleanup
Threat Removal
Remove Backdoors
Remove Persistence
Reset Credentials
Fix Configuration Issues
Security Hardening 🔐
Patch Systems
Update Rules
Improve Monitoring
Apply Security Baselines
8.6️⃣ Incident Recovery 🔄
System Restoration 💻
Restore Services
Restore Backups
Validate Systems
Business Recovery 🏢
Critical Services Recovery
Application Recovery
User Access Restoration
Monitoring After Recovery 👁️
Continuous Monitoring
Threat Hunting
Security Validation
8.7️⃣ Digital Forensics & Investigation 🔬
Memory Forensics
Volatility 3
RAM Analysis
Disk Forensics
File Recovery
Timeline Analysis
Artifact Analysis
Network Forensics
PCAP Analysis
Wireshark
Tcpdump
Malware Investigation
Static Analysis
Dynamic Analysis
Sandbox Analysis
8.8️⃣ Incident Reporting 📑
Executive Report
Business Impact
Risk Summary
Recommendations
Technical Report
Attack Timeline
Indicators of Compromise
Root Cause
Evidence
Compliance Reporting
NCA Requirements
Regulatory Reporting
Audit Evidence
🎯 8️⃣ Incident Response Lifecycle
1️⃣ Prepare 📝
2️⃣ Detect 🔍
3️⃣ Analyze 🔬
4️⃣ Contain 🛑
5️⃣ Eradicate 🧹
6️⃣ Recover 🔄
7️⃣ Improve 📈