Application Security
Study Material

Definition

A cyber incident may include events such as malware infections, ransomware attacks, phishing campaigns, data breaches, insider threats, or Distributed Denial-of-Service (DDoS) attacks.

Main Goal

To minimize damage, reduce recovery time and costs, protect organizational reputation, and prevent similar incidents from occurring in the future — following the NIST lifecycle model.

Common Types of Cyber Incidents

1. Malware Attacks: Malicious software (viruses, trojans, ransomware, spyware) that disrupts, damages, or gains unauthorized access to systems.
2. Phishing & Social Engineering: Deceptive emails or messages that trick users into revealing credentials or installing malware. Example: Fake bank emails with malicious links.
3. Data Breaches: Unauthorized access to confidential data — customer records, financial info, intellectual property.
4. DDoS (Distributed Denial of Service): Floods a server or network with traffic from multiple sources to make services unavailable to legitimate users.
5. Insider Threats: Malicious or negligent actions by employees, contractors, or business partners with internal access.
6. Unauthorized Access: An attacker gains access to systems, networks, or data without permission — often through stolen credentials.

Why Incident Response is Important

• Reduces financial losses from breaches, downtime, and regulatory fines.
• Protects organizational reputation by demonstrating control and responsibility.
• Ensures legal and regulatory compliance (GDPR, HIPAA, ISO 27001).
• Minimizes downtime and business disruption.
• Improves future security posture through lessons learned.

NIST Incident Response Lifecycle

Detailed Phase Breakdown

1. Preparation: This is the most important phase. Develop an incident response policy, create playbooks for common threats (ransomware, phishing), define roles and responsibilities, train the CSIRT (Computer Security Incident Response Team), and deploy SIEM/IDS tools.
2. Identification: Monitor systems continuously. When an alert fires, analysts determine if it's a true positive incident — not just a false alarm. They analyze logs, network traffic, and user behavior to determine the scope and severity.
3. Containment: Act quickly to prevent the incident from spreading. This may involve isolating affected machines from the network, blocking malicious IPs, or disabling compromised user accounts.
4. Eradication: After containment, fully remove the threat. This includes deleting malware, patching the exploited vulnerability, resetting compromised credentials, and closing entry points.
5. Recovery: Restore affected systems from clean backups and bring services back online in a controlled manner. Monitor closely for any signs of re-infection.
6. Lessons Learned: After recovery, the team holds a review meeting to document what happened, how it was handled, what worked, and what needs improvement. The IR plan is updated accordingly.

Definition

10 Steps of Incident Response Planning

1. Establish Objectives and Scope: Define what the plan aims to protect (data, systems, networks). Identify critical assets and business priorities. Determine which types of incidents are covered (malware, insider threats, DDoS, etc.).
2. Develop an Incident Response Policy: Create a formal policy approved by senior management. Define authority levels and decision-making structure. Align with standards such as NIST SP 800-61 or ISO/IEC 27035.
3. Form the Incident Response Team (IRT): Assign clear roles — Incident Manager, Security Analysts, IT Support, Legal & Compliance, Communication/PR. Define contact details and escalation paths for each role.
4. Identify Critical Assets and Risks: Conduct risk assessments to identify vulnerabilities and potential threats. Prioritize systems based on their impact and sensitivity to the organization.
5. Develop Response Procedures and Playbooks: Create step-by-step procedures for common incident types (ransomware, phishing, data breach). Include containment, eradication, and recovery instructions. Define evidence handling procedures (chain of custody for forensics).
6. Implement Detection and Monitoring Tools: Deploy SIEM systems, Intrusion Detection Systems (IDS), and Endpoint Detection & Response (EDR). Set up alert mechanisms and define logging policies.
7. Establish a Communication Plan: Define internal communication channels. Prepare notification templates for management, employees, customers, and regulatory authorities. Plan for media handling if a major breach occurs.
8. Training and Awareness: Conduct regular employee security training. Perform incident response drills and tabletop simulations to test team readiness.
9. Testing and Review: Perform tabletop exercises and penetration testing. Identify gaps in the existing plan and update it regularly.
10. Plan Maintenance and Continuous Improvement: Review the plan after every incident. Update based on lessons learned. Adapt to new threats and evolving technologies.

Definition

Key Technologies

Importance of These Technologies

• Faster Detection: Helps catch threats before they spread widely across the network.
• Automated Responses: Reduces manual analyst workload and speeds up mitigation actions through automation.
• Better Coordination: Provides responders with contextual insights and unified views of attacks across the entire environment.

Definition

Key Phases of an IR Strategy

1. Preparation: Develop policies, identify critical assets, train the CSIRT (Computer Security Incident Response Team), and set up tools for detection and analysis. This phase creates the foundation for all subsequent phases.
2. Detection and Analysis: Continuously monitor systems to identify potential security incidents. Determine the incident's scope and severity. Classify the type of attack.
3. Containment, Eradication, and Recovery: Isolate affected systems to prevent spread, eliminate the threat (malware/attacker presence), restore services safely from clean backups.
4. Post-Incident Activity: Document everything, conduct a "lessons learned" review with all stakeholders, and update the strategy to improve future responses.

Essential Elements for a Successful IR Strategy

1. Defined Roles: Clearly identify who is responsible for declaring an incident, managing communications, executing technical tasks (forensics, remediation), and legal obligations. Without defined roles, response becomes chaotic.
2. Incident Playbooks: Specific, step-by-step instructions for common scenarios like ransomware attacks, phishing incidents, insider threats, or data breaches. Playbooks eliminate guesswork under pressure.
3. Communication Plan: Establish secure, out-of-band communication channels for the IR team. Regular corporate email may be compromised during an incident. Include templates for notifying management, staff, customers, and regulators.
4. Documentation: Keep a detailed incident log tracking all actions taken. This is critical for legal and forensic purposes, regulatory compliance reporting, and future improvement.
5. Regular Training: Conduct tabletop exercises to simulate real incidents and test the plan. Ensures team members know their roles and can act confidently without referring to documentation every step.

Memorize these in order — they're likely to appear in list-type questions.

1. Broken Access Control — Users accessing what they shouldn't
2. Cryptographic Failures — Weak encryption / plain-text sensitive data
3. Injection — SQL, NoSQL, OS command injection
4. Insecure Design — Architectural flaws, no threat modeling
5. Security Misconfiguration — Default creds, open cloud storage
6. Vulnerable & Outdated Components — Unpatched libraries
7. Identification & Authentication Failures — Weak passwords, no MFA
8. Software & Data Integrity Failures — Insecure CI/CD, bad updates
9. Security Logging & Monitoring Failures — No alerts, no audit logs
10. Server-Side Request Forgery (SSRF) — Server fetches attacker-controlled URLs