News headlines usually only cover a breach at the moment it's disclosed. What they rarely show is the weeks or months of structured, high-pressure work that happens before that headline exists - the process called incident response. It's one of the most important practical skills in cybersecurity, and understanding it turns a scary, abstract idea ("we got hacked") into a manageable, structured process.
The 6 Phases of Incident Response
Most organizations follow a version of the NIST incident response lifecycle:
- Preparation - before anything happens: incident response plans, trained staff, monitoring tools, and defined roles are already in place.
- Identification - detecting that something abnormal is actually happening, and confirming it's a genuine security incident, not a false alarm.
- Containment - stopping the incident from spreading further, often split into short-term containment (immediate isolation) and long-term containment (temporary fixes while a permanent solution is built).
- Eradication - removing the actual root cause: malware, backdoors, compromised accounts, or the vulnerability that allowed entry in the first place.
- Recovery - safely restoring affected systems to normal operation, with careful monitoring to confirm the threat is genuinely gone.
- Lessons Learned - a formal post-incident review: what happened, how it was handled, and what changes will prevent a repeat.
Real-World Case Study: The 2020 SolarWinds Attack
What happened: SolarWinds, a major IT management software vendor, was compromised by sophisticated attackers who inserted malicious code directly into a legitimate, digitally-signed update for its widely-used Orion network-monitoring platform. Roughly 18,000 organizations - including multiple U.S. government agencies and Fortune 500 companies - downloaded the compromised update, unknowingly installing a backdoor. The attack was ultimately discovered in December 2020 by the cybersecurity firm FireEye, after its own internal security team noticed anomalous behavior tied to its own breach - and traced the intrusion back to the tampered SolarWinds update.
Walking this through the incident response lifecycle shows exactly why each phase matters:
- Identification: FireEye's own security team detected unusual, unauthorized activity in their internal systems - a strong monitoring and detection capability is what surfaced the very first signal.
- Containment: once the compromised update was identified as the entry point, SolarWinds and affected organizations moved to isolate systems running the tampered Orion software and revoke exposed credentials.
- Eradication: the malicious update had to be identified and removed across every affected organization's environment - a massive undertaking given how widely the software was deployed.
- Recovery: organizations rebuilt trust in their environments, often rebuilding affected systems from scratch rather than assuming they were fully clean.
- Lessons Learned: the incident triggered a broad industry-wide re-evaluation of software supply-chain security, influencing new government policy and vendor security requirements that followed in the years after.
Who's Actually Involved in a Real Incident Response
- Incident Response (IR) analysts: the technical team investigating, containing, and remediating the incident directly.
- Legal counsel: advises on regulatory disclosure obligations, which vary significantly by industry and region.
- Communications/PR: manages what's disclosed publicly and when, balancing transparency against operational security.
- Executive leadership: makes high-stakes calls (e.g. whether to pay a ransom, when to notify customers) with input from all of the above.
- External specialists: many organizations bring in a dedicated incident response firm for major incidents, since deep forensic investigation is a specialized skill most internal teams don't need day-to-day.
Why Speed and Documentation Both Matter
Key Principle: every action taken during an incident must be carefully documented - what was found, when, by whom, and what action was taken. This isn't just bureaucracy: it's often required for legal/regulatory purposes, it's essential for the post-incident "lessons learned" review, and in serious cases it may become evidence in a criminal investigation.
What Students Should Take From This
- A breach isn't a single event - it's a process with distinct, learnable phases, each requiring different skills.
- Strong detection and monitoring (like FireEye's own internal team catching the SolarWinds anomaly) is often what turns a catastrophic, undetected breach into a contained, manageable one.
- Incident response is a genuine career specialization, with certifications like GCIH and hands-on practice in realistic lab environments building the exact skills used in cases like this.
- Every organization, no matter how well-resourced, is a potential target - what actually varies is how quickly and effectively they can detect and respond.
Key Takeaways
- Incident response follows six structured phases: preparation, identification, containment, eradication, recovery, and lessons learned.
- The 2020 SolarWinds attack is one of the most significant supply-chain incidents in history, and shows how each phase played out at massive real-world scale.
- Detection and monitoring capability is often the deciding factor in how much damage a breach ultimately causes.
- Documentation throughout the process is not optional - it's legally and operationally essential.
