Post-incident review in Cybersecurity - Mini Project: Build & Apply

Post-incident Review Process

📖 Scenario: You are part of a cybersecurity team that just handled a security incident. Now, you need to create a clear and organized post-incident review document to learn from the event and improve future responses.

🎯 Goal: Build a step-by-step post-incident review document that includes the incident details, impact assessment, lessons learned, and improvement actions.

📋 What You'll Learn

Create a dictionary called incident_details with exact keys and values describing the incident

Add a variable called impact_level to classify the severity of the incident

Use a list comprehension called lessons_learned to extract key lessons from a list of observations

Add a final dictionary called improvement_plan summarizing actions to prevent future incidents

💡 Why This Matters

🌍 Real World

Post-incident reviews help cybersecurity teams understand what happened, how it affected the organization, and what to do next to avoid similar problems.

💼 Career

Security analysts and incident responders regularly create post-incident reports to improve defenses and communicate with stakeholders.

1

Create Incident Details

Create a dictionary called incident_details with these exact entries: 'date': '2024-05-15', 'type': 'Phishing Attack', 'detected_by': 'Email Filter', and 'status': 'Resolved'.

Cybersecurity

# Create the incident_details dictionary with the specified keys and values
# Your code here

Hint

Use curly braces to create a dictionary and include the exact keys and values as strings.

2

Add Impact Level

Add a variable called impact_level and set it to the string 'High' to classify the severity of the incident.

Cybersecurity

incident_details = {
    'date': '2024-05-15',
    'type': 'Phishing Attack',
    'detected_by': 'Email Filter',
    'status': 'Resolved'
}

# Add the impact_level variable and set it to 'High'
# Your code here

Hint

Simply assign the string 'High' to the variable named impact_level.

3

Extract Lessons Learned

Given the list observations = ['User clicked suspicious link', 'Email filter caught 3 phishing emails', 'No data breach occurred'], create a list comprehension called lessons_learned that includes only observations containing the word 'phishing'.

Cybersecurity

incident_details = {
    'date': '2024-05-15',
    'type': 'Phishing Attack',
    'detected_by': 'Email Filter',
    'status': 'Resolved'
}

impact_level = 'High'

observations = ['User clicked suspicious link', 'Email filter caught 3 phishing emails', 'No data breach occurred']

# Create lessons_learned list with observations containing 'phishing'
# Your code here

Hint

Use a list comprehension to filter observations that include the word 'phishing'.

4

Add Improvement Plan

Add a dictionary called improvement_plan with these exact entries: 'training': 'Increase phishing awareness', 'filter_update': 'Enhance email filter rules', and 'monitoring': 'Implement real-time alerts'.

Cybersecurity

incident_details = {
    'date': '2024-05-15',
    'type': 'Phishing Attack',
    'detected_by': 'Email Filter',
    'status': 'Resolved'
}

impact_level = 'High'

observations = ['User clicked suspicious link', 'Email filter caught 3 phishing emails', 'No data breach occurred']

lessons_learned = [obs for obs in observations if 'phishing' in obs]

# Create improvement_plan dictionary with specified keys and values
# Your code here

Hint

Use a dictionary with the exact keys and string values as shown.

Practice

1. What is the main purpose of a post-incident review in cybersecurity?

easy

A. To analyze the incident and improve future responses

B. To punish the person responsible for the incident

C. To delete all evidence of the incident

D. To ignore minor incidents and focus on major ones only

Solution

1. Step 1: Understand the goal of post-incident reviews

   Post-incident reviews aim to learn from security events by analyzing what happened.

2. Step 2: Identify the correct purpose

   The review helps improve future responses and reduce risks, not punish or ignore incidents.

3. Final Answer:

   To analyze the incident and improve future responses -> Option A

4. Quick Check:

   Purpose = Analyze and improve [OK]

Hint: Focus on learning and improvement after incidents [OK]

Common Mistakes:

• Thinking it's about blaming individuals
• Assuming it deletes incident data
• Believing minor incidents are ignored

2. Which of the following is the correct step to include in a post-incident review?

easy

A. Ignoring the timeline of events

B. Skipping communication with the team

C. Deleting logs to save space

D. Documenting what happened during the incident

Solution

1. Step 1: Identify key steps in post-incident reviews

   Documenting the incident details is essential for understanding and learning.

2. Step 2: Evaluate the options

   Ignoring timelines, deleting logs, or skipping communication harm the review process.

3. Final Answer:

   Documenting what happened during the incident -> Option D

4. Quick Check:

   Key step = Document incident [OK]

Hint: Always document incident details clearly [OK]

Common Mistakes:

• Ignoring event timelines
• Deleting important logs
• Avoiding team communication

3. After a cybersecurity incident, a team performs a post-incident review and finds that the root cause was a weak password policy. What is the most likely outcome of this review?

medium

A. The team will delete all user accounts

B. The team will ignore password policies and focus on firewalls

C. The team will strengthen password policies to prevent future incidents

D. The team will stop using passwords altogether

Solution

1. Step 1: Analyze the root cause identified in the review

   The weak password policy is the main problem found during the review.

2. Step 2: Determine the logical improvement

   Strengthening password policies addresses the root cause and improves security.

3. Final Answer:

   The team will strengthen password policies to prevent future incidents -> Option C

4. Quick Check:

   Root cause fix = Strengthen passwords [OK]

Hint: Fix root causes found in reviews [OK]

Common Mistakes:

• Ignoring the root cause
• Taking extreme unrelated actions
• Removing all user accounts unnecessarily

4. A team conducted a post-incident review but forgot to include communication with stakeholders. What is the likely problem caused by this omission?

medium

A. Stakeholders remain uninformed, causing confusion and mistrust

B. The incident will be automatically resolved

C. The team will have too much information

D. The incident will not be recorded in logs

Solution

1. Step 1: Understand the role of communication in post-incident reviews

   Communicating with stakeholders ensures transparency and trust.

2. Step 2: Identify the consequence of missing communication

   Without communication, stakeholders stay uninformed, leading to confusion and mistrust.

3. Final Answer:

   Stakeholders remain uninformed, causing confusion and mistrust -> Option A

4. Quick Check:

   Missing communication = Confusion [OK]

Hint: Always include stakeholders in reviews [OK]

Common Mistakes:

• Assuming incidents resolve without communication
• Thinking too much info is a problem
• Confusing communication with logging

5. During a post-incident review, a team finds that multiple alerts were ignored because they were considered false positives. How should the team improve their process to avoid missing real threats?

hard

A. Delete alert logs after 24 hours

B. Implement a better alert validation process to distinguish real threats from false positives

C. Ignore all alerts to save time

D. Only respond to alerts during business hours

Solution

1. Step 1: Identify the problem with ignoring alerts

   Ignoring alerts without proper validation risks missing real threats.

2. Step 2: Determine the best improvement

   Implementing a better validation process helps correctly identify real threats and reduce false alarms.

3. Final Answer:

   Implement a better alert validation process to distinguish real threats from false positives -> Option B

4. Quick Check:

   Improve alert handling = Better validation [OK]

Hint: Validate alerts carefully to catch real threats [OK]

Common Mistakes:

• Ignoring all alerts blindly
• Deleting logs too soon
• Limiting response times unnecessarily