Lesson 13 — Advanced

Incident Response & Forensics

Attack kabhi na kabhi ho sakta hai — asli skill hai uska structured response. Is lesson mein hum incident response ke 6 phases, digital forensics ka evidence handling aur common mistakes samjhenge — SOC/IRT teams ka roz ka workflow yahi hai.

⏱ 15 min• Advanced• Security Tools

Incident kya hai, response kya hai

WHAT

Incident = aisa event jo actual nuksaan ya breach la sakta hai (malware, unauthorized access, data leak). Incident Response (IR) = uska structured handling — identify, contain, fix, learn. Forensics uske evidence collect karne ka scientific part hai.

WHEN

Jab data leak ho, account compromise ho, ransomware aaye, ya suspicious activity dikhe — turant IR chahiye. Jitna jaldi, utna kam nuksaan.

WHERE

Company ka SOC/IRT team, unka IR plan, aur national level pe CERT-In — sab isi process par chalte hain.

Event vs Incident: Event = kuch hua (ek failed login bhi), Incident = usse impact hai ya hone wala hai. Har incident event hai, har event incident nahi.

IR lifecycle — 6 phases

IR LIFECYCLE (6 phases):
1. PREPARATION    : plan, team, tools, contacts, playbook ready
2. IDENTIFICATION : incident confirm — kya, kab, kaise? (triage)
3. CONTAINMENT    : affected system ko attack se ALAG karo
                    short-term: disconnect | long-term: isolate segment
4. ERADICATION    : malware/root cause remove — hole band karo
5. RECOVERY       : clean se restore, patch, aur monitor
6. LESSONS LEARNED: report, plan improve, team train

GOLDEN RULES:
  Pehle EVIDENCE save, phir clean-up
  Panic se nuksaan attack se zyada hota hai
  Log karte jao — timeline baad mein sabse zaroori

Interview question: Q: "Attack hua — pehla kya karoge?" A: Assess + contain — affected system ko network se alag karo, management ko inform karo, evidence preserve karo. Turant OFF kar dena bhi galat hai (evidence RAM se chali jaayegi).

Digital forensics basics

VOLATILE DATA PELHE collect karo (power jaate hi gaya):
  1. RAM        : running process, keys, commands
  2. Network connections
  3. Running services/sessions
Phir : storage ka FORENSIC IMAGE banao
  (original pe MAT chalo — copy pe kaam karo)

EVIDENCE principles:
  Chain of custody : har evidence ka record
                    (kisne, kab, kahan handle kiya)
  Integrity        : SHA-256 hash se verify karo
                    (image asli jaisi hai — proof)
  Spoliation       : evidence destroy karna = case kharab

Why : courtroom/IR report mein proof chahiye ki data baad mein nahi badla

Forensics ka soul ek line hai: "Do no harm." Investigation ke dauran evidence ko chhedna nahi — warna uski value khatam ho jaati hai. Isliye copy pe kaam karo, original ko seal rakho.

Communication, metrics aur backup

Communication: kisko notify — management, legal, customers, aur zarurat pe CERT-In/nodal officer.
Metrics: MTTD (kitne mein detect) aur MTTR (kitne mein resolve) — dono track hoti hain.
Backup 3-2-1: 3 copies, 2 media, 1 OFFSITE/immutable — ransomware se sirf yahi bachata hai.
Ransomware: payment policy ke against — pehle CERT-In/law enforcement, decryption ka chance bhi hota hai (No More Ransom jaisi initiatives).
Post-incident: blameless review — insaan nahi, process improve karna hai.

Disclosure: kuch incidents report karne legally zaroori hote hain (CERT-In directions ke under organizations ko specified incidents report karne hote hain). Chhupana aksar attack se zyada nuksaan deta hai — reputation + legal dono.

Exercise

Question: Affected system ko attack se alag karne wala phase kya kehlata hai? (containment/eradication)

Question: Forensics mein sabse pehle kaunsa data collect hota hai — RAM ya printer log? (ram/printer)

Question: 3-2-1 backup rule mein "1" ka matlab kya hai? (ek copy offsite / ek password)

Common mistakes

Incident dekhte hi system reboot kar dena: RAM (running process, keys) gayab ho jaayegi. Pehle volatile evidence capture, phir isolate, phir recovery.
Panic mein sab kuch band kar dena: Containment zaroori hai par evidence bhi. Bina plan ke power off = investigation khatam, attacker bach gaya.
IR plan sirf paper pe rakha: Plan bina drill ke kaam nahi aata. Tabletop exercise se team ko pata chalta hai kya karna hai — warna waqt pe confusion.

Desi example: SME ransomware incident

Chhoti firm ko subah 9 baje alert mila — HR share ke files .locked extension mein. Kya hua, step by step (textbook response):

09:00 Identify : files locked + ransom note dikha
09:10 Contain  : PC ko network se alag kiya
09:20 Evidence : screenshots + ransom note save
09:30 Escalate : management + CERT-In route
10:00 Recover  : OFFLINE backup se restore
Result: business 1 din mein chalu, ransom NAHI diya
Lesson: immutable backup = asli insurance

Exam mapping (Security+ / CEH / Interview)

Security+ : IR phases (containment pehle ya eradication) — direct question.
CEH: chain of custody + volatile order (RAM first).
Interview: "Ransomware aaya toh kya karoge?" — structured answer chahiye.
Trap: "Erase the malware first, then contain" — galat, pehle contain, phir eradicate.

Lesson complete?

IR ka process clear. Agla lesson — Cyber Law & Ethics — mein dekhenge IT Act ke sections aur complaint ka sahi raasta.