Web Security & OWASP (50 Qs)•Part 5: API Security, DevSecOps & Enterprise Incident Handling (43 - 50)
Security Incident Response: Containment, forensic evidence preservation, and the GDPR 72-hour reporting rule.
High-Stakes Incident Response Lifecycle
When an active security breach occurs, chaotic reactions can destroy forensic evidence or trigger catastrophic legal liabilities. Enterprise teams operate under the NIST SP 800-61 Incident Handling Framework.
lua
+---------------------+ +---------------------+ +---------------------+
| 1. Preparation | --> | 2. Detection & | --> | 3. Containment, |
| (Runbooks, WAF, SIEM| | Analysis | | Eradication & |
| forensic toolkits) | | (Verify compromise) | | Recovery |
+---------------------+ +---------------------+ +---------------------+
|
v
+---------------------+
| 4. Post-Incident |
| Activity & Audit |
+---------------------+
1. Containment (Stop the Bleeding)
- Do NOT reboot or power off the infected machine: Powering down wipes volatile RAM memory containing injected malware payloads, network connections, and unencrypted keys.
- Isolate Network: Detach security groups or apply a quarantine NetworkPolicy to block all outbound and inbound traffic while keeping the VM/container running for live memory forensics.
- Rotate Root Credentials: Immediately invalidate all active session tokens, rotate database master passwords, and regenerate signing keys.
2. Regulatory Compliance: The GDPR 72-Hour Rule
Under the General Data Protection Regulation (GDPR Article 33), if a security breach involves personal data of EU citizens, organizations are legally required to notify the supervisory authority within 72 hours of becoming aware of the breach, accompanied by an assessment of the likely consequences and mitigation measures taken.