Incident Response / DR / BC Case Study
This portfolio-safe case study summarizes selected CYBER 342W Cyber Incident Handling and Response work focused on incident response planning, NIST 800-61 concepts, CSIRT structure, incident communication, containment, eradication, recovery, post-incident activity, disaster recovery, business continuity, and cybersecurity writing.
Overview#
CYBER 342W focused on cyber incident handling and response from both a technical and professional communication perspective.
The strongest portfolio angle for this course is incident response planning and disaster recovery readiness. The work included a group incident response plan for a simulated enterprise environment, NIST 800-61-style lifecycle planning, CSIRT role definition, communication strategy, policy development, evidence handling, containment and recovery planning, post-incident lessons learned, business continuity planning, and individual writing assignments on cybersecurity incidents and response recommendations.
This page is intentionally written as a portfolio-safe summary. It does not publish raw academic submissions, full group reports, private student identifiers, complete presentation content, internal course materials, or step-by-step incident procedures.
Why This Project Matters#
Incident response is not only a technical workflow. It is also an organizational discipline.
A strong incident response plan requires:
- clear roles and responsibilities
- defined incident declaration authority
- communication paths
- evidence-handling expectations
- escalation criteria
- legal and HR coordination
- coordination with external parties
- backup and recovery planning
- documentation standards
- incident prioritization
- post-incident lessons learned
- executive-level reporting
CYBER 342W helped connect technical incident response with policy, governance, documentation, and business continuity.
This makes the course useful evidence for cybersecurity analyst, ServiceNow SecOps, vulnerability management, GRC-aware security operations, and incident response support roles.
Portfolio-Safe Publishing Approach#
Security and privacy note: This case study summarizes incident response planning and writing-intensive coursework without publishing raw group submissions, private student details, full academic reports, private diagrams, exact team member information, or complete incident response procedures.
This page excludes:
- raw group submissions
- full presentations
- private student identifiers
- complete organizational diagrams
- complete incident response policy text
- full academic answers
- internal course materials
- exact personal contact details
- full source documents
- step-by-step operational procedures
Instead, it presents:
- incident response themes
- planning structure
- portfolio-safe summaries
- framework alignment
- writing and communication lessons
- disaster recovery and business continuity concepts
- cybersecurity policy and response lessons
Major Workstreams#
Incident Response Plan#
Developed a structured incident response plan for a simulated enterprise environment, including roles, lifecycle phases, communication expectations, policy considerations, and response responsibilities.
IR Planning
NIST 800-61 Lifecycle#
Aligned the incident response plan to preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
NIST 800-61
CSIRT Structure#
Defined incident response governance, CSIRT roles, CISO authority, internal coordination, escalation paths, and responsibilities during an incident.
CSIRT
Communication Strategy#
Addressed internal and external communication, legal review, HR coordination, law enforcement escalation, external incident response support, and need-to-know disclosure.
Communication
Disaster Recovery / Business Continuity#
Explored disaster preparedness, employee check-in systems, alert rosters, power outage planning, secondary site coordination, and business continuity documentation.
DR / BC
Cybersecurity Writing#
Completed writing-intensive assignments translating cyber incidents, DNS hijacking, data breach prevention, IT auditing, and disaster recovery planning into professional recommendations.
Writing Intensive
Incident Response Lifecycle Evidence#
Preparation#
Planned resources, tools, communication lists, security controls, backup tools, encryption software, network diagrams, SIEM support, endpoint protection, authentication controls, and incident response documentation.
Preparation
Detection and Analysis#
Focused on identifying precursors and indicators, reviewing logs, receiving outside reports, prioritizing incident handling, safeguarding incident data, correlating events, and understanding normal network behavior.
Detection
Containment#
Planned containment strategy around limiting loss, preventing exfiltration, reducing operational disruption, preserving evidence, and coordinating response activity.
Containment
Eradication#
Outlined the need to remove the threat, eliminate malicious activity, address root causes, and support remediation after the scope and source of the incident are understood.
Eradication
Recovery#
Connected recovery to restoration of critical services, validation of restored systems, backup strategy, operational continuity, and stakeholder communication.
Recovery
Post-Incident Activity#
Addressed lessons learned, process review, cost analysis, improvement planning, control updates, and preparation for future incidents.
Lessons Learned
Group Incident Response Planning#
The main group project developed a formal incident response plan for a simulated enterprise organization.
The plan included:
- incident response capability definition
- incident response goals
- preparation activities
- identification and detection process
- containment strategy
- eradication planning
- recovery planning
- post-incident activity
- cyber incident response governance team
- CSIRT responsibilities
- CISO incident declaration authority
- communication plan
- legal and HR coordination
- external incident response vendor involvement
- law enforcement escalation considerations
- evidence handling expectations
- information sharing considerations
- automation and coordination concepts
The project reinforced that incident response is a coordinated business process, not only a technical investigation.
CSIRT and Governance Concepts#
The incident response plan included defined responsibility areas for governance and response teams.
Key concepts included:
- incident response governance oversight
- CISO-led incident declaration
- cybersecurity team response responsibilities
- network operations involvement
- IT service involvement
- communications coordination
- legal and HR involvement
- contracted incident response vendor coordination
- incident severity and risk classification
- authority for monitoring and retrieving relevant organizational data during investigations
- need-to-know communication principles
- external disclosure control
This supports a governance-aware cybersecurity perspective because response teams need clear authority before an incident occurs.
Detection and Analysis Concepts#
The project emphasized detection and analysis as a structured process.
Areas included:
- precursors and indicators
- outside-party incident reporting
- logging and auditing procedures
- information recording
- safeguarding incident data
- incident prioritization
- network and system profiling
- normal behavior baselining
- log retention
- event correlation
- host clock synchronization
- knowledge base development
This maps closely to security operations because analysts must determine whether activity is normal, suspicious, or confirmed incident behavior.
Containment, Eradication, and Recovery Concepts#
The plan addressed containment, eradication, and recovery from both technical and operational perspectives.
Themes included:
- containment strategy
- evidence gathering and handling
- volatile data capture
- forensic disk imaging
- hot and cold backup considerations
- system restoration
- service recovery
- remediation validation
- reducing disruption of services
- preventing additional data loss
- removing threat activity
- restoring critical computing services
This is relevant to incident response and ServiceNow SecOps because both require documented remediation, clear ownership, validation, and closure.
Communication and Information Sharing#
The project included a communication strategy for internal and external coordination.
Topics included:
- CISO-led communication during incident confirmation
- internal need-to-know communication
- legal review before external coordination
- HR coordination for internal threats
- law enforcement escalation
- external incident response vendor support
- notification considerations for affected individuals
- information sharing agreements
- automation of information sharing
- relevance, timeliness, and security of shared information
- avoiding unnecessary disclosure during active incidents
This reinforced that incident communication must be deliberate, controlled, legally reviewed, and tied to the severity of the incident.
Disaster Recovery and Business Continuity Evidence#
Individual assignments and bonus work supported disaster recovery and business continuity planning.
Topics included:
- disaster preparedness
- business continuity planning
- disaster recovery planning
- employee alert rosters
- employee check-in systems
- sequential and hierarchical notification methods
- power outage planning
- communication infrastructure failures
- use of secondary coordination sites
- evacuation and shelter-in-place considerations
- backup records
- emergency employee alert lists
- personal emergency readiness
- go-kit planning
- continuity needs for computing and connectivity
This strengthens the course as a DR/BC evidence point, especially for roles where cyber incident response intersects with operational resilience.
Individual Writing Assignment Themes#
Tool and Control Concepts Referenced#
The course work referenced or evaluated several tools, platforms, and security controls in an incident response context:
Capability-to-Evidence Map#
What I Learned#
This course reinforced several lessons that matter in cybersecurity operations and consulting:
- incident response should be planned before an incident occurs
- response teams need defined authority and escalation paths
- communication failures can create incident response failures
- documentation is critical during detection, containment, recovery, and review
- legal, HR, communications, vendors, and law enforcement may all be part of an incident response process
- evidence handling must be planned and controlled
- logs, baselines, and event correlation are central to incident detection
- backup and recovery planning must be tested before a real incident
- business continuity requires people, process, facilities, and communication planning
- technical incidents must be translated into clear professional recommendations
- cybersecurity writing matters because incident response depends on clarity, precision, and stakeholder trust
Professional Relevance#
This project supports roles involving:
- cybersecurity analysis
- security operations
- incident response
- disaster recovery
- business continuity
- vulnerability management
- ServiceNow SecOps consulting
- security policy support
- GRC-aware cybersecurity work
- technical writing and security documentation
- stakeholder communication
It also supports my ServiceNow SecOps direction because structured incident response maps well to ServiceNow security workflows: triage, assignment ownership, communication, remediation tracking, validation, closure, documentation, and post-incident review.
Difference from CYBER 440 Capstone#
CYBER 342W and CYBER 440 both relate to incident response, but they show different strengths.
Together, they show both sides of incident response: planning the response program and investigating a simulated incident.
Portfolio-Safe Redaction Notes#
This case study intentionally excludes:
- raw group submissions
- full presentations
- complete incident response plans
- private student identifiers
- private organizational diagrams
- exact team member details
- full academic answers
- internal course materials
- complete procedural steps
The goal is to show planning, policy, response structure, and professional communication without publishing raw academic work.
Related Portfolio Areas#
Incident Response#
This course supports incident response readiness through planning, governance, detection, containment, recovery, and lessons learned.
IR Planning
Disaster Recovery / Business Continuity#
The course connected cyber incidents to outage planning, communication resilience, backup strategy, emergency readiness, and continuity planning.
DR / BC
ServiceNow SecOps#
ServiceNow SecOps workflows benefit from clear incident ownership, communication, documentation, remediation tracking, validation, and closure.
SecOps-Relevant
GRC and Policy#
The work includes policy, governance structure, external coordination, legal considerations, information sharing, and business impact thinking.
GRC-Relevant
Next Steps#
This project can later be connected to:
- a ServiceNow Security Incident Response workflow concept
- a disaster recovery / business continuity capability section
- a CSIRT role mapping page
- an incident communication checklist
- a NIST 800-61 lifecycle diagram
- a policy-to-workflow mapping example
- a ServiceNow SecOps incident response case concept
For now, this page serves as the main portfolio-safe summary of my CYBER 342W Cyber Incident Handling and Response work.