Incident responders are sometimes referred to as digital forensics incident responders or DFIR. The National Institute of Standards and Technology (NIST) defines digital forensics as the application of science to the identification, collection, examination and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data. (For more on this job title, see Digital forensics careers: Public vs. private sector.) But in fact, there are nuanced differences between an incident responder and someone who works as a DFIR. While a DFIR may be narrowly focused on the intricacies of a specific attack (similar but not the same as a malware analyst who works to reverse-engineer attacks), an incident responder is sometimes referred to as a cybersecurity first-responder. They are the first line of defense an organization relies on to mitigate a real-time attack and ensure a quick recovery. “Every incident is slightly different,” says Keatron Evans, a senior instructor at Infosec and managing consultant at KM Cyber Security, LLC. “I feel like I learn something every time. It’s a very exciting career to be in.”
What does an incident responder do?
NIST defines incident response as the mitigation of violations of security policies and recommended practices. Incident responders are first on the scene to assess what happened and then apply effective mitigation strategies that are both effective and efficient. Cyber incidents are costly, and the quicker the bleeding can be stopped, the better. On a more strategic level, incident responders are also responsible for designing and implementing an incident response plan. These plans will often look different from one organization to the next. However, their goal is the same: to identify, remediate and recover from cyber incidents. In the NIST Computer Security Incident Handling Guide, they recommend an incident response plan that contains four primary subject areas:
Preparation, which includes the identification of preventative measures Detection and analysis, which includes areas such as indicators, required documentation and notification Containment, eradication and recovery, which includes choosing a containment strategy, gathering evidence and identifying attacking hosts Post-incident activity, which includes lessons learned and evidence retention policies
Some incident responders work for a large company as part of an incident response team led by an incident manager. Others, like Evans, work as part of a consulting firm that provides incident response services, or they may work independently. As a consultant, Evans says he’s “worked with incident responders within an organization when they realize which skills they have on their team and which skills they don’t. They know to reach out and get [a team like his consultancy] involved.”
What does it take to be an incident responder?
Core to being a good incident responder are two common security positions: strong communication skills and problem-solving. “We think about incident response as more of a technical thing, and it is, but there’s a whole soft management side to it where you have to communicate details of the incident to the right people, at the right time,” Evans says. Communication and being calm are keys, Evans explains. One real-life example is the LinkedIn data breach from a few years ago when the company first announced 7 million records were hacked. Then, they had to come back out and say it was actually 117 million records. “The technical side is binary. Your technique will work, or it won’t. The people side can be more challenging sometimes; you have to be good at communicating with people, telling them what they need to know when, and calming them down.” An ability to problem-solve is also essential. How you approach a problem and how persistent you can be in understanding the challenge and solving it helps incident responders succeed. As Evans explains, one of his best penetration testers has a liberal arts background. Still, an interest in computers and tremendous problem-solving abilities lead her to methodically figure things out and excel in the position. That’s not to say technical skills aren’t necessary too. To be a good incident handler, it’s crucial to have a strong foundation in computer security followed by a mastery of the offensive side of hacking, including ethical hacking and penetration testing, and then forensics. Certification and training that will help you hone your skills and demonstrate them to potential employers include:
Ethical hacking: Certified Ethical Hacker (CEH), PenTest+ and OSCP certifications; or training in cloud, mobile and web application pentesting Incident response: IR and Network Forensics Boot Camp; or training in network traffic analysis or incident response Digital forensics: Certified Computer Forensics Examiner (CCFE) and Certified Mobile Forensics Examiner (CMFE) certifications; or a variety of training in different forensic areas
Technical training is necessary for incident responders to do their jobs effectively and to excel in their profession. As Evans puts it, “training was the glue or the hub that allowed me to meet the right people, interact with the right people, and be able to get into security roles.” For more on this topic, watch the Cyber Work Podcast, How to become an incident responder with Keatron Evans.
Sources
Digital forensics, NIST Computer Security Resource Center Incident response, NIST Computer Security Resource Center Computer Security Incident Handling Guide, NIST
