Incident Response
Incident ResponseIncident Response (IR) is the structured process for handling security incidents. The NIST SP 800-61 Rev. 2 framework defines four phases: (1) Preparation, (2) Detection & Analysis, (3) Containment, Eradication & Recovery, (4) Post-Incident Activity. In practice, these are commonly broken into operational steps:
- Detection: identify the incident through alerts, monitoring, or reports
- Containment: limit the blast radius (isolate instances, deactivate keys, block IPs)
- Eradication: remove the threat (delete backdoors, patch vulnerabilities, clean compromised resources)
- Recovery: restore normal operations (deploy clean resources, validate integrity, re-enable access)
- Lessons Learned: post-incident review, update runbooks, improve detection
Related AWS Services
Related Content
Related Terms
The scope of impact when a security incident occurs - how many resources, accounts, or users are affected. Smaller blast radius means better security posture.
The incident response phase where you isolate affected resources to prevent the threat from spreading - deactivating keys, quarantining instances, blocking network access.
The process of identifying potential security threats, malicious activity, and anomalous behavior in your AWS environment using automated monitoring tools.
The practice of collecting, preserving, and analyzing digital evidence from cloud resources after a security incident to understand what happened and how.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.