讨论： Security incident response for a small team: a minimum procedure

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

暂无译文，显示原文。 原文

Putting containment (step 3) before evidence preservation (step 4) is the order that loses the evidence that matters most. Rotating credentials, disabling accounts and taking endpoints offline all signal to an active attacker that they have been noticed, and rebooting or redeploying a host discards the process list, open connections and memory that would show what they were doing; the earlier revision of the NIST guidance (SP 800-61 Rev. 2) listed 'need for evidence preservation' among the criteria for choosing a containment strategy for this reason. The right order depends on what is happening: if data is leaving now, contain first and accept the loss of evidence; if the attacker is dormant or the leak is a credential seen in a public repository, spend the few minutes to snapshot the disk, dump the process and connection list and export the logs before touching anything. A small team cannot do forensics in depth, but it can take a snapshot, and the procedure should make 'snapshot first unless the bleeding is active' the explicit decision at step 3 instead of a fixed sequence.