The IR lifecycle

The model: four phases, not a straight line

When people picture incident response they picture the middle of it — the war room, the bridge call, the frantic typing. NIST SP 800-61 (the field’s reference, Computer Security Incident Handling Guide) frames it more usefully as a lifecycle of four phases that loop, not a script you run once top to bottom:

1. Preparation — everything you build before an incident: the response team and its authority, runbooks, log pipelines, tooling, retained backups, contact lists, and the practice runs that make all of it real.
2. Detection & Analysis — noticing that something happened and figuring out what: triaging an alert, confirming it’s a true incident, scoping how far it reaches, and assigning severity.
3. Containment, Eradication & Recovery — stopping the bleeding, removing the attacker’s access and artifacts, then restoring service to a known-good state and confirming it holds.
4. Post-Incident Activity — the “lessons learned” pass: a blameless review that turns what you just lived through into improvements.

The arrow that matters most is the one that loops the last phase back to the first. Post-Incident Activity feeds Preparation. A finding from one incident — “we had no log of service-account reads” — becomes a Preparation task that makes the next Detection phase faster. An IR program that skips the loop relives the same incident every quarter; one that closes it gets measurably harder to breach over time.

Why Preparation decides the outcome

Here is the senior insight that the four-box diagram hides: the phases are not equal in leverage. During an actual incident, the clock is running and your options are fixed — you can only respond with the access, logs, tooling, and authority that already exist. You cannot decide during the breach to start retaining the logs you’ll need to scope it. You cannot grant yourself the cloud permission to isolate a node while the attacker is using it. You cannot write, socialize, and rehearse a runbook at 2:47 a.m. Every capability you reach for under pressure was either built in Preparation or it simply isn’t there.

This is why mature teams measure two numbers: MTTD (mean time to detect) and MTTR (mean time to respond/recover). Both are dominated by Preparation. MTTD is short only if you were already logging the right events with the right context and had detections watching them — that’s the previous unit’s work, cashed in here. MTTR is short only if the runbook exists, the responder has standing authority to act, and the recovery path (clean backups, infrastructure-as-code to rebuild) was tested before the day you need it. The breach in the Hook lost forty minutes not to a hard technical problem but to missing Preparation: no clear incident commander, a stale runbook, no pre-granted permissions. The attack succeeded in the gaps the team never closed on a calm afternoon.

Detection, Containment, and the tradeoffs inside them

The middle phases carry their own senior judgment calls. Detection & Analysis is where you resist two opposite failures: declaring an incident on every noisy alert (alert fatigue, wasted response), or dismissing a real one as noise. The discipline is triage — confirm it’s a true positive, then scope it (what’s affected, how far, since when) before you act, because containment decisions are only as good as your understanding of blast radius. ATT&CK is the shared vocabulary that makes scoping concrete: naming the adversary’s techniques (credential access, lateral movement, exfiltration) tells you where else to look before you declare the incident bounded.

Containment hides the sharpest tradeoff in the whole lifecycle: containment versus evidence. The instinct is to pull the plug — power off the compromised box the instant you find it. But a hard power-off destroys volatile evidence (memory, live network connections, the malware’s running state) and tips the attacker off, who may have other footholds you haven’t found yet. Isolating the host on the network instead preserves forensics and may let you watch the attacker’s other moves. Yet waiting too long lets exfiltration continue. There is no universal right answer — only a judgment weighing active damage against the value of evidence and the risk of a wider, undetected presence.