Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few days after) or both?
1 Answer
Short answer: Both.
Longer answer follows.
Incident response actually starts before either of these two cases. A mature incident response plan has specific classifications on what qualifies as an incident, and that can vary from organization to organization, but there is a second term, event. Before it is confirmed that malware is spreading on the network and incident response needs to respond, several events are likely to have occurred. One event would the user's machine sending out enormous amounts of requests for what host is alive on the network. Another event would be the user going to a questionable website. And so on, and so on. At least some of these events should be captured by logging systems on the network. Some would be caught by the user. "Hey, I got this weird email and I opened the attachment," should be a giant flashing red light that something is wrong.
How an organization classifies events, and how they handle them is up to the powers-that-be. If the IR team was spun up every time "something weird" happened, they'd probably quit from burnout.
Incident Response is a collection of technology (SIEM, logging, email filtering), and policies. I can't tell you how to organize and manage those things, because that is up to each company.
Back to your question. It's both, and more.
