05 - Post-Incident Activity and Lessons Learned

The post-incident phase is arguably the most important for improving an organization's security posture over time. Failing to learn from an incident guarantees it will happen again.

1. Blameless Retrospectives

A core principle of modern incident response is the Blameless Post-Mortem.

• Goal: The goal is to understand what happened, why it happened, and how to prevent it, NOT to punish individuals.
• Assumption: Assume everyone involved did their best with the information and tools they had at the time.
• Focus on Systems: If an engineer clicked a phishing link, the failure isn't the human; the failure is the lack of technical controls (MFA, email filtering, endpoint protection) that allowed the click to result in a compromise.

2. Root Cause Analysis (RCA)

RCA aims to find the underlying vulnerability or process failure that initiated the incident.

The "5 Whys" Technique

Ask "Why?" repeatedly until you reach the fundamental process or systemic failure.

• Problem: The database was compromised with ransomware.
• Why? An attacker gained RDP access to the server.
• Why? The server was exposed directly to the internet.
• Why? A firewall rule was misconfigured during maintenance.
• Why? There was no peer review process for firewall changes.
• Root Cause: Lack of change management and peer review for critical infrastructure changes.

3. Writing the Post-Mortem Report

A comprehensive report should be generated within a week of the incident closure.

Standard Report Structure:

1. Executive Summary: High-level overview of the incident, impact, and root cause (for leadership).
2. Incident Timeline: Detailed, chronological log of events (Attacker actions and Responder actions).
3. Root Cause Analysis: Detailed explanation of the technical and systemic failures.
4. Impact Assessment: Quantification of data lost, systems affected, and business downtime.
5. Containment and Eradication Steps: What was done to stop the threat.
6. Action Items (Lessons Learned): Specific, trackable tasks to improve defenses.

4. Implementing Lessons Learned

The action items from the report must be prioritized and tracked to completion. Examples include:

• Updating Controls: Implementing MFA, tuning WAF rules, deploying new EDR signatures.
• Process Updates: Modifying change management, updating the IR playbook itself.
• Training: Conducting targeted security awareness training based on the attack vector.
• Visibility Improvements: Ensuring logs that were missing during the investigation are collected and forwarded to the SIEM.