Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ 1 NIST SP 800-61 Computer Security Incident Handling Guide - Coggle…
🛡️ 1 NIST SP 800-61 Computer Security Incident Handling Guide
🐧 Enterprise Linux Incident Response Framework
📌 Used By
1️⃣ SOC Operations Center
2️⃣ Incident Response Team
3️⃣ Security Operations Engineers
4️⃣ Government Organizations
5️⃣ Banking & Financial Enterprises
6️⃣ Cloud Security Teams
7️⃣ Critical Infrastructure Organizations
🚨 Incident Response Lifecycle
1️⃣ Preparation Phase
🎯 Objective
Build capability to detect, respond, investigate, and recover from security incidents
🏢 Enterprise Planning
📄 Incident Response Policy
Define incident severity levels
Define roles and responsibilities
Define communication process
Define escalation procedures
👥 Incident Response Team
SOC Analyst
Incident Handler
Forensic Analyst
Linux Administrator
Network Security Engineer
Threat Intelligence Analyst
Management Stakeholders
🐧 Linux Security Preparation
🔐 System Hardening
CIS Linux Benchmark
Disable unnecessary services
Remove unused packages
Secure SSH configuration
Enable firewall
Configure SELinux/AppArmor
👤 Identity Management
Strong password policy
MFA implementation
sudo privilege control
Least privilege access
User account review
🔑 SSH Security
/etc/ssh/sshd_config
Disable root login
PermitRootLogin no
Disable password authentication
PasswordAuthentication no
Use SSH keys
Enable MFA
🧱 Firewall Preparation
Ubuntu
UFW
RHEL/CentOS
firewalld
Enterprise Firewall
Network segmentation
DMZ protection
East-West traffic control
📊 Logging Infrastructure
Local Logs
/var/log/
Authentication Logs
Ubuntu
/var/log/auth.log
RHEL
/var/log/secure
System Logs
/var/log/syslog
Kernel Logs
dmesg
Centralized Logging
Separate Log Server
Prevent attackers deleting evidence
SIEM Integration
Elastic SIEM
Splunk
QRadar
Sentinel
⏰ Time Synchronization
chrony
Purpose
Maintain accurate timestamps
Importance
Correlate events across servers
Support forensic investigation
🧰 Security Tools Preparation
Host Monitoring
OSSEC
Wazuh
AIDE
Vulnerability Scanner
Nessus
OpenVAS
Qualys
Rootkit Detection
rkhunter
chkrootkit
Forensics Tools
Autopsy
Sleuth Kit
Volatility
2️⃣ Detection & Analysis Phase
🎯 Objective
Identify suspicious activity
Confirm security incident
Determine impact
🔍 Detection Sources
SIEM Alerts
Failed login attempts
Malware detection
Privilege escalation
Suspicious processes
IDS/IPS Alerts
Network attacks
Port scanning
Command and control traffic
Endpoint Detection
File Integrity Monitoring
AIDE
OSSEC
Malware Detection
ClamAV
EDR agents
🐧 Linux Investigation Commands
👤 User Investigation
Check logged users
who
w
last
Check user accounts
cat /etc/passwd
cat /etc/shadow
🔑 Authentication Investigation
Failed login attempts
grep Failed /var/log/auth.log
Successful logins
last
SSH activity
journalctl -u ssh
⚙️ Process Investigation
Running processes
ps aux
Real-time monitoring
top
htop
Suspicious processes
pstree
lsof
🌐 Network Investigation
Active connections
ss -tulpn
Open ports
netstat -tulpn
Packet analysis
tcpdump
Wireshark
📁 File Investigation
Recently modified files
find / -mtime -1
SUID files
find / -perm -4000
File integrity
aide --check
🧠 Incident Analysis
Determine
What happened?
When happened?
Which systems affected?
Who performed activity?
Attack method?
Business impact?
3️⃣ Containment Phase
🎯 Objective
Limit attacker activity
Prevent further damage
🟡 Short Term Containment
Network Isolation
Disconnect compromised server
Block attacker IP
Disable network interface
Firewall Blocking
iptables
firewalld
Security Groups
Account Control
Disable compromised users
usermod -L username
Reset passwords
Remove SSH keys
🔵 Long Term Containment
Build isolated investigation environment
Preserve evidence
Create forensic image
Apply temporary security controls
4️⃣ Eradication Phase
🎯 Objective
Remove attacker presence completely
🦠 Malware Removal
Identify malicious files
Remove malware
Scan system
🔍 Root Cause Analysis
Determine
Initial access method
Vulnerability exploited
Compromised account
Malware technique
🛠 System Cleaning
Remove unauthorized users
Remove backdoors
Remove suspicious cron jobs
Check cron
crontab -l
ls /etc/cron.*
Check services
systemctl list-unit-files
Check startup programs
systemctl list-units
🔐 Security Improvement
Patch vulnerabilities
Update packages
apt update && apt upgrade
yum update
Harden configuration
Improve monitoring
5️⃣ Recovery Phase
🎯 Objective
Restore normal business operation safely
💾 System Restoration
Restore backups
Rebuild compromised servers
Validate system integrity
🧪 Security Validation
Vulnerability scanning
Configuration review
Malware scanning
📈 Monitoring
Increased monitoring period
SIEM correlation rules
Alert tuning
✅ Return To Production
Management approval
Business validation
Documentation completed
6️⃣ Post-Incident Activity
🎯 Objective
Learn and improve security capability
📄 Incident Report
Executive Summary
Technical Timeline
Root Cause
Impact Analysis
Evidence Collected
Remediation Actions
🔄 Lessons Learned
What worked?
What failed?
What should improve?
🛡 Security Improvement
Update policies
Improve detection rules
Improve logging
Update playbooks
Train employees
📚 Knowledge Base
Create incident documentation
Update SOC procedures
Update response checklist
🏢 Enterprise Linux Incident Response Architecture
🖥 Linux Servers
Web Servers
Database Servers
Application Servers
Cloud Servers
📡 Data Collection
Filebeat
Auditd
Sysmon Linux
OSSEC/Wazuh Agent
🧠 SIEM Platform
Elasticsearch
Kibana
Logstash
Splunk
👨💻 SOC Team
Level 1 Analyst
Alert Monitoring
Level 2 Analyst
Investigation
Level 3 Analyst
Threat Hunting
Incident Handler
Containment & Recovery
📊 Incident Severity Classification
🔴 Critical
Root compromise
Data breach
Ransomware
🟠 High
Malware infection
Privilege escalation
🟡 Medium
Suspicious login
Policy violation
🟢 Low
Failed login attempts
Minor alerts
🧪 Practical Linux Incident Response Workflow
1️⃣ Receive Alert
2️⃣ Validate Incident
3️⃣ Collect Evidence
4️⃣ Analyze Logs
5️⃣ Identify Attack Path
6️⃣ Contain System
7️⃣ Remove Threat
8️⃣ Restore Service
9️⃣ Document Findings
🔟 Improve Security Controls
🛡️ NIST SP 800-61
Computer Security Incident Handling Guide
1️⃣ Definition
A cybersecurity incident response guideline
developed to help organizations prepare for,
detect, analyze, contain, eradicate, and recover
from security incidents.
2️⃣ Organization
National Institute of Standards and Technology (NIST)
U.S. Government Standards Organization
Develops cybersecurity guidelines
Used worldwide by enterprises
3️⃣ Main Purpose
Create an enterprise incident handling program
Establish a structured response process
Improve incident detection and management
Reduce business impact of cyber attacks
Improve security after incidents
4️⃣ Usage
Enterprise incident response programs
Security policies and procedures
Governance and compliance activities
SOC operations
Incident response teams
Cybersecurity risk management
5️⃣ Audience
CISO
Security Managers
Incident Response Teams
SOC Analysts
Security Engineers
IT Administrators
6️⃣ Style
Structured guideline
Formal methodology
Policy-driven approach
Enterprise-focused framework
7️⃣ Focus
Complete incident management lifecycle
Incident preparation
Detection and analysis
Containment
Eradication
Recovery
Post-incident improvement
8️⃣ Incident Response Lifecycle
Preparation
Create incident response plan
Build response team
Deploy security tools
Enable logging and monitoring
Establish communication process
Detection & Analysis
Identify security events
Analyze alerts
Validate incidents
Determine impact
Collect evidence
Containment
Limit attacker activity
Isolate affected systems
Block malicious access
Prevent further damage
Eradication
Remove malware
Remove persistence mechanisms
Patch vulnerabilities
Secure compromised accounts
Recovery
Restore systems
Validate security
Monitor for recurrence
Return to normal operation
Post-Incident Activity
Create incident report
Perform root cause analysis
Document lessons learned
Improve controls
Update response procedures