07 - References and Further Reading

To deepen your understanding of Incident Response, refer to the following industry standards, frameworks, and tool documentation.

Standards and Frameworks

• NIST SP 800-61 Revision 2: Computer Security Incident Handling Guide

  • Description: The foundational government standard for establishing an incident response capability and handling incidents effectively.
  • Link: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

• SANS Incident Handler's Handbook

  • Description: A practical, widely-used guide outlining the 6 steps of incident response (PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).
  • Link: https://www.sans.org/white-papers/33901/

• MITRE ATT&CK Framework

  • Description: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Essential for understanding attacker behavior during the Analysis phase.
  • Link: https://attack.mitre.org/

Forensic Tools Documentation

• Volatility 3

  • Description: The volatile memory extraction utility framework.
  • Link: https://volatility3.readthedocs.io/
  • GitHub: https://github.com/volatilityfoundation/volatility3

• KAPE (Kroll Artifact Parser and Extractor)

  • Description: A tool to quickly collect and parse forensic artifacts.
  • Link: https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape

• Velociraptor

  • Description: Advanced endpoint visibility and digital forensics tool.
  • Link: https://docs.velociraptor.app/

Cloud Incident Response

• AWS Security Incident Response Guide

  • Link: https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/welcome.html

• Microsoft Azure Incident Response Playbooks

  • Link: https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks