PPIVTR-D

Running the response loop

Put the same question to every new fact: does this change scope, containment, eradication or recovery? If it does, the team is on another pass. Say so on the bridge, because silence reads as progress and stakeholders start planning the all-clear.

Linear flow from attacker through Contain, Eradicate and Recover, with three missed threats marked around the sequence.
Figure 67. Three threats pass through unnoticed.
Circular flow of Scope, Contain, Eradicate and Recover with three threat icons inside the loop, each caught on a successive iteration.
Figure 68. The same three threats, caught across successive passes.

A straight line through contain, eradicate and recover misses whatever only becomes visible once the evidence has been read. That is the difference the two figures are drawing.

TriggerLooks likeNext move
New indicatorsA PowerShell script in a registry key, traffic to unknown C2Back to scoping with the new indicator
Scope expansionA known compromised service account also active in a regulated systemAnother scoping pass, with new stakeholders and new obligations
Incomplete eradicationA system that looked clean shows reinfectionHunt the missed persistence or the unidentified access vector
Analysis revelationsMemory forensics finds a second malware familyRescope, then revisit containment and eradication
Business changeA new obligation or a shift in prioritiesRe-triage and reset the plan with decision makers

Before exiting

#Item
1Scoping produces no new indicators
2Monitoring shows no attacker activity
3Eradication verification confirms removal
4Restored systems operate normally
5Operational objectives met and residual risk acceptable
6Cost and benefit no longer favor active response
7Regulatory conditions for closure satisfied
8Ongoing monitoring decided and assigned an owner
9Technical closure signed and residual risk accepted, both with names and times
Watch out
  • Rotate people and schedule rest. Fatigue accumulates across iterations and rarely appears in any report.
  • Documentation has to survive shift handover, or incoming analysts repeat work or skip it.
  • Name the person who authorizes the exit. An attributed written decision holds up if the incident is reopened or reviewed, and people commit more carefully when their name is on it.