Incident Response Plan Template SANS

Standard Operating Procedure: Incident Response (IR)

Template Registry Engineering Standards

---

1. Document Control Block

---

2. Executive Summary & Purpose

This document establishes the standardized framework for detecting, analyzing, containing, and recovering from cybersecurity incidents within Template Registry infrastructure. The objective is to minimize dwell time, preserve forensic integrity, and ensure operational continuity.

---

3. Scope & Prerequisites

• Scope: All production environments, cloud VPCs, CI/CD pipelines, and corporate identity providers (IdP).
• Required Tools:
  • SIEM (e.g., Splunk/ELK)
  • Endpoint Detection & Response (EDR) agents
  • Secure communication channel (Out-of-Band, e.g., Signal or encrypted Slack)
  • Forensic imaging utilities
• Prerequisites: All responders must possess active credentials to the IR management platform and signed "Rules of Engagement" on file.

---

4. Roles & Responsibilities (RACI)

---

5. Step-by-Step Procedure

Phase I: Identification & Triage

• Validate alert trigger via SIEM correlation rules.
• Define severity level (Low, Medium, High, Critical).
• Establish Out-of-Band (OOB) communications bridge.
• Document initial timestamp and indicators of compromise (IOCs).

Phase II: Containment

• Isolate affected hosts at the network layer (VPC Security Group modification).
• Revoke compromised IAM credentials and rotate secrets.
• Snapshot affected storage volumes for forensic analysis.
• Prevent further propagation (e.g., disable compromised service accounts).

Phase III: Eradication

• Perform root cause analysis (RCA) to identify the entry vector.
• Purge malware/persistence mechanisms from identified systems.
• Rebuild affected infrastructure from "Known Good" Infrastructure-as-Code (IaC) templates.
• Apply security patches or configuration hardening.

Phase IV: Recovery & Post-Mortem

• Restore services into the clean environment.
• Monitor logs for 72 hours for signs of re-infection.
• Conduct a formal "Blameless Post-Mortem" meeting.
• Update documentation and security controls based on lessons learned.

---

6. Quality Assurance & Pro-Tips

• Pro-Tip (The "Golden Image" Rule): Never attempt to clean an infected OS. Always terminate and redeploy from verified IaC templates to ensure zero persistence.
• Forensic Integrity: Always snapshot before termination. If you lose the volatile memory (RAM), you lose the evidence required for long-term threat intelligence.
• Metric Thresholds:
  • Mean Time to Acknowledge (MTTA): < 15 minutes.
  • Mean Time to Contain (MTTC): < 2 hours for critical incidents.

---

7. Frequently Asked Questions

Q: At what point do we contact legal/external authorities? A: Immediate notification is required if PII (Personally Identifiable Information) or sensitive client data is confirmed as exfiltrated, or if required by contractual Service Level Agreements (SLAs).

Q: Should I reboot an infected system to "clear" the error? A: Absolutely not. Rebooting clears volatile memory (RAM) where active malware and decryption keys often reside. Always perform a memory dump before any power-state changes.

Q: Who is authorized to initiate an emergency lockdown? A: Any member of the SecOps team has the authority to initiate a containment lockdown; however, the Incident Commander must be briefed within 10 minutes of execution.