The First 90 Seconds of Incident Response

The First 90 Seconds of Incident Response

The initial 90 seconds of an incident response investigation are crucial, as they set the tone for the entire process, with responders making key decisions on evidence preservation and logging visibility that can significantly impact the outcome. According to Eric Zimmerman, Principal Instructor at SANS Institute, the first 90 seconds are not just about reacting quickly, but about establishing a direction for the investigation before assumptions harden and options disappear.

Why This Matters

Incident response failures often stem from early decisions made under pressure, with incomplete information, rather than a lack of tools or technical skills. The consequences of these failures can be significant, with the average cost of a data breach exceeding $4 million, highlighting the importance of getting the initial response right. Understanding the technical reality of incident response, including the importance of evidence preservation and logging visibility, is critical to resolving incidents efficiently and effectively.

Key Insights

• Early incident response decisions, such as evidence preservation and logging visibility, determine investigation success: A study by IBM found that the average cost of a data breach is $4.24 million, emphasizing the need for effective incident response.
• Consistency in approach is key to successful incident response, with responders applying the same discipline every time they touch a new system: This includes understanding what was executed, when it was executed, and what happened around it.
• Logging that starts after detection can be damaging, as it limits visibility into the incident: Forward visibility without backward context makes it difficult to reconstruct the attack and can lead to assumptions and mistakes.

Working Example

# Example of logging configuration to preserve evidence
import logging

# Set up logging configuration
logging.basicConfig(
    format='%(asctime)s %(levelname)s: %(message)s',
    datefmt='%Y-%m-%d %H:%M:%S',
    level=logging.INFO
)

# Log critical events
try:
    # Code to execute
    pass
except Exception as e:
    logging.critical('Error occurred: %s', e)

Practical Applications

• Use Case: Companies like Google and Microsoft have implemented incident response plans that prioritize evidence preservation and logging visibility, enabling them to respond quickly and effectively to security incidents.
• Pitfall: Premature closure of incidents can lead to secondary implants and alternate credentials being left behind, creating the illusion of success when the incident is not fully remediated: This can result in repeated incidents and increased costs.

References:

• http://thehackernews.com/2026/02/the-first-90-seconds-how-early.html
• https://www.ibm.com/security/data-breach
• https://www.sans.org/course/advanced-incident-response-threat-hunting-digital-forensics