The Recovery Orange Book

Detection of a cyber incident typically involves continuous monitoring of networks, systems, and endpoints for abnormal activity. Indicators of a breach can manifest in various forms, including alerts from antivirus software or network intrusion detection sensors, the appearance of filenames with unusual characters, evidence of auditing configuration changes, failed login attempts from unfamiliar remote systems, or variations from normal network traffic. Once suspicious activity is flagged, it is crucial to gather information to determine whether an actual security event has occurred. This initial identification should be promptly reported to the designated incident response team, with meticulous documentation of all findings. Incident management software plays a vital role in this stage, helping to identify and categorize incidents by analyzing alerts and correlating them into actionable incidents. Furthermore, prioritizing incidents based on their severity and potential impact on the organization is essential, as not all incidents require the same level of urgency or response.

Alert Triage and Validation

Confirming a breach

This phase of cyber investigation involves the critical process of verifying whether a security incident is indeed a breach. Organizations typically find or detect a breach through various anomalies across their IT infrastructure and then confirm it by correlating these signals from different security lanes.

Organizations can confirm a breach by correlating information and coordinating communications across several lanes:

• Establishing authority or owner: Clearly define who has the final say on declaring a security incident a breach and initiating the response.

• Comms plan ownership: IR leader should determine which crisis communications plan is important, and kickoff any discussions.

• Activating IR plan: Immediately trigger the incident response (IR) plan or a specific runbook based on the confirmed breach type and severity.

• Host artifacts: Look for unusual services, scheduled tasks, unfamiliar parent-child process trees, or tampering with antivirus/EDR solutions. Another indicator can be sudden file name changes, new files appearing in bulk, and any of a set of unfamiliar file extensions, (e.g., .onion, new .zip or .tar or .lck extensions). Ransomware usually adds an extension to encrypted files, (e.g., .aaa, .micro, .ttt, .xyz, .locky, .crypt, .petya, etc.) to show the files are encrypted. The file extension is usually unique to the ransomware type, but the names can vary.

• Anomalous network activity: First times are interesting, like initiating network connections to new cloud storage buckets or vendors like Dropbox, Box, unsanctioned Google Drive or Sharepoint, or other new connections — especially by service accounts or other largely unmonitored automated services.

• Identity anomalies: Investigate first-time login locations or devices, bursts of MFA fatigue, ad-hoc administrative grants, or consented OAuth applications that seem out of place. All unusual or unscheduled AD admin activity, should be escalated every time it happens, (e.g., Creating an AD account with an open ADCS certificate tmolate, etc.)

• Backup anomalies: Monitor for sudden surges in change rates, tampering with retention policies, immutable policy changes, failed replications, "quarantined restore" triggers, or positive results from restore-time malware scans.

Initial Scope Determination

Determining the scope of the incident involves identifying which systems have been compromised, what data has been accessed or affected, and the overall impact of the breach on organizational operations. This includes a thorough analysis of the incident and the correlation of various events to build a comprehensive picture. This initial assessment is fundamental, as it provides the necessary intelligence for making informed decisions regarding subsequent containment and recovery efforts.

Mobilize Incident Response Team:

As soon as a breach is suspected, activate your incident response team or plan. Depending on the organization, this team can include IT security staff, IT ops, forensic specialists, legal counsel, communications, management, and HR. Assign an incident manager to coordinate efforts. Small businesses that lack in-house experts should engage external incident response consultants (many maintain retainer agreements for on-demand assistance). Enterprises should ensure their 24/7 on-call responders are alerted immediately.

Preservation of Evidence

Preserving digital evidence is paramount for both legal proceedings and comprehensive post-incident analysis.2 It requires securing and collecting forensic data in a manner that maintains its integrity and ensures its admissibility in a court of law.

Forensics Imaging

The immediate aftermath of a breach demands a rapid and effective response, yet a critical consideration can be the explicit warning against immediately shutting down systems.8 Such an action can lead to the loss of crucial forensic evidence and hinder the investigation process. This highlights a fundamental tension: the need for swift action to contain the threat versus the need for careful, deliberate action to preserve volatile data for a thorough investigation. Incident response teams must be trained in forensic techniques that allow for live data collection and imaging before any disruptive containment actions are taken. This necessitates specialized tools, such as live memory forensics and disk imaging devices, combined with predefined, well-rehearsed procedures to navigate this critical trade-off effectively. The emphasis shifts from simply "fastest possible action" to "fastest forensically sound action," ensuring that immediate tactical decisions do not compromise strategic long-term objectives like legal recourse or comprehensive root cause analysis.

An organization's landscape of digital evidence has expanded far beyond traditional endpoints and web servers. While initial forensic efforts often focused on computers and hard drives, the increasing prevalence of mobile devices, cloud computing, Software as a Service, artificial intelligence, machine learning, and the Internet of Things (IoT) means that potential evidence sources are now far more diverse. Organizations must continually update their incident response plans, forensic capabilities, and training programs to account for these varied and distributed data sources across hybrid and multi-cloud environments, mobile devices, and emerging technologies. This requires ongoing investment in advanced forensic tools and expertise that can operate across these varied platforms, ensuring that critical evidence is not overlooked or inaccessible due to technological blind spots.

Furthermore, the repeated emphasis on "admissibility in court"  and the critical role of "chain of custody"  underscore that digital forensics is not merely a technical investigation but a legally sensitive process - especially if your organization is looking to attempt to sue for damages. The explicit warning that evidence "will not be admissible in court" if not properly handled5 highlights a severe consequence. Failure to adhere to strict, documented evidence preservation protocols can have profound legal ramifications, undermining internal investigations, limiting the ability to prosecute perpetrators, and severely hampering legal recourse (e.g., securing court-ordered damages), defending against lawsuits, and demonstrating regulatory compliance. This elevates digital forensics from a purely technical task to a critical legal imperative, requiring close collaboration between IT/security teams and legal counsel.

The following table outlines best practices for digital evidence preservation:

Legal considerations are paramount in this phase. Digital evidence must be relevant, authentic, and its chain of custody unbroken to be admissible in court. Forensic professionals must also adhere to ethical guidelines, respecting privacy and avoiding unauthorized data access. Frameworks such as NIST SP 800-86 and ISO/IEC 27037 provide comprehensive guidance for conducting digital forensics investigations, emphasizing the importance of integrity and authenticity throughout the process.