{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/incident-response","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/incident-response/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/incident-response/"},"term":{"en":"Incident response","da":"Hændelseshåndtering"},"aka":{"en":["incident handling","incident management"],"da":["incident response"]},"domain":["security"],"cluster":"incident-response","layer":"governance","status":"current","era":1988,"summary":{"en":"The organised way a company spots, stops and cleans up after a security attack or accident, then gets back to normal.","da":"Den organiserede måde, en virksomhed opdager, stopper og rydder op efter et sikkerhedsangreb eller uheld og vender tilbage til normal drift."},"body":{"formal":{"en":"A prepared cycle of phases - preparation, detection and analysis, containment, removal of the cause, recovery, and review afterwards - carried out by named people with agreed authority when a security incident occurs.","da":"Et forberedt forløb i faser - forberedelse, opdagelse og analyse, inddæmning, fjernelse af årsagen, genopretning og efterfølgende evaluering - som udføres af navngivne personer med aftalte beføjelser, når en sikkerhedshændelse indtræffer."},"plain":{"en":"Like a fire drill that turns into the real thing - everyone knows who calls for help, who closes the doors and who counts heads.","da":"Ligesom en brandøvelse, der bliver til virkelighed - alle ved, hvem der ringer efter hjælp, hvem der lukker dørene, og hvem der tæller, om alle er kommet ud."},"inPractice":{"en":"At three in the morning the SIEM at a municipality flags a strange login; the on-call technician locks the account, cuts the laptop off the network and calls the incident lead.","da":"Klokken tre om natten slår en kommunes SIEM alarm over et mærkeligt login; den vagthavende tekniker spærrer kontoen, kobler den bærbare fra netværket og ringer til den ansvarlige for hændelsen."},"whyItMatters":{"en":"Minutes count during an attack, and a team that improvises loses time, evidence and money that a prepared team keeps.","da":"Minutter tæller under et angreb, og et team, der improviserer, mister tid, spor og penge, som et forberedt team bevarer."}},"deepDive":{"en":"The discipline dates from the Morris worm of November 1988, after which DARPA funded the CERT Coordination Center at Carnegie Mellon; FIRST, the global forum of response teams, followed in 1990. For two decades the dominant process model has been the NIST SP 800-61 lifecycle, whose Revision 2 (2012) describes four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Revision 3 (April 2025) retired that lifecycle and instead maps incident response onto the six Functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), treating preparation and improvement as continuous rather than as phases. The SANS six-step model (preparation, identification, containment, eradication, recovery, lessons learned) splits the same work differently. ISO/IEC 27035-1:2023 frames it as plan and prepare, detect and report, assess and decide, respond, and learn lessons.\n\nNIST SP 800-61 Revision 3, finalised in April 2025, withdrew Revision 2 and re-expressed incident response through the six functions of the Cybersecurity Framework 2.0. Govern, Identify and Protect cover the preparation that makes response possible; Detect covers finding and analysing adverse events; Respond covers incident management, analysis, reporting and communication, and mitigation; and Recover covers restoration and recovery communication. The change reflects the view that incident response is an organisation-wide capability tied to risk management rather than a separate team's process, and that lessons learned should feed improvement continuously, not only at the end.\n\nTechnically, detection and analysis rely on correlated telemetry from SIEM, EDR, identity provider and network logs, triage against a severity scheme, and scoping by searching for indicators of compromise and attacker techniques across the estate. Evidence is collected in order of volatility, as described in RFC 3227 (memory, network state and running processes before disk), with hashes and a chain of custody if legal action is possible. Containment choices are trade-offs: isolating a host with EDR keeps it available for forensics, while pulling the power destroys memory; resetting a compromised account before understanding the attacker's persistence can alert them and trigger destructive action. Eradication must remove every foothold, including scheduled tasks, web shells, new accounts, OAuth grants and, after domain compromise, the krbtgt key, which is reset twice.\n\nIncident response is distinct from its neighbours. Crisis management is the leadership layer that makes business decisions around the incident, business continuity keeps operations running meanwhile, and disaster recovery restores technology after large-scale loss. Incident reporting to authorities under NIS2, GDPR or DORA is one of the obligations handled within incident response. In practice many Danish organisations rely on an external incident response retainer, whose activation procedure, contact details and pre-agreed access must be part of the preparation.","da":"Disciplinen går tilbage til Morris-ormen i november 1988, hvorefter DARPA finansierede CERT Coordination Center ved Carnegie Mellon; FIRST, det globale forum for responsteams, fulgte i 1990. I to årtier har den dominerende procesmodel været livscyklussen i NIST SP 800-61, hvis Revision 2 (2012) beskriver fire faser: forberedelse; opdagelse og analyse; inddæmning, fjernelse og genopretning; og aktiviteter efter hændelsen. Revision 3 (april 2025) opgav den livscyklus og knytter i stedet hændelseshåndtering til de seks funktioner i NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), så forberedelse og forbedring ses som løbende arbejde frem for faser. SANS' model i seks trin (preparation, identification, containment, eradication, recovery, lessons learned) deler det samme arbejde op på en anden måde. ISO/IEC 27035-1:2023 beskriver det som planlægning og forberedelse, opdagelse og rapportering, vurdering og beslutning, respons og erfaringsopsamling.\n\nNIST SP 800-61 Revision 3, der blev endelig i april 2025, trak Revision 2 tilbage og udtrykker nu hændelseshåndtering gennem de seks funktioner i Cybersecurity Framework 2.0. Govern, Identify og Protect dækker den forberedelse, der gør respons mulig; Detect dækker at finde og analysere uønskede hændelser; Respond dækker hændelsesstyring, analyse, rapportering og kommunikation samt afhjælpning; og Recover dækker genopretning og kommunikation om genopretningen. Ændringen afspejler synet på hændelseshåndtering som en kapabilitet i hele organisationen, knyttet til risikostyring, frem for et enkelt teams proces, og at erfaringer skal føde forbedringer løbende, ikke kun til sidst.\n\nTeknisk bygger opdagelse og analyse på korreleret telemetri fra SIEM, EDR, identitetsudbyderen og netværkslogs, triage efter en alvorlighedsskala og afgrænsning ved at søge efter kompromitteringsindikatorer og angriberteknikker i hele miljøet. Beviser indsamles i rækkefølge efter flygtighed som beskrevet i RFC 3227 (hukommelse, netværkstilstand og kørende processer før disk), med hashværdier og en dokumenteret kæde for håndtering af beviser, hvis retsforfølgning er mulig. Valg af inddæmning er afvejninger: at isolere en maskine med EDR bevarer den til forensisk analyse, mens at trække strømmen sletter hukommelsen; at nulstille en kompromitteret konto, før man forstår angriberens fodfæste, kan advare angriberen og udløse ødelæggende handlinger. Fjernelsen skal omfatte ethvert fodfæste, herunder planlagte opgaver, web shells, nye konti, OAuth-samtykker og efter kompromittering af domænet krbtgt-nøglen, der nulstilles to gange.\n\nHændelseshåndtering adskiller sig fra sine naboer. Krisestyring er ledelseslaget, der træffer forretningsbeslutninger omkring hændelsen, driftskontinuitet holder driften i gang imens, og disaster recovery genopretter teknikken efter omfattende tab. Indberetning til myndigheder efter NIS2, databeskyttelsesforordningen eller DORA er en af de forpligtelser, der håndteres inden for hændelseshåndteringen. I praksis bruger mange danske organisationer en ekstern incident response-leverandør på retainer, og aktiveringsproceduren, kontaktoplysningerne og den forhåndsaftalte adgang skal være en del af forberedelsen."},"edges":[{"type":"requires","to":"security/threat","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/data-breach","why":{"en":"Fast containment limits how much data leaks and for how long.","da":"Hurtig inddæmning begrænser, hvor meget data der lækker, og hvor længe."},"confidence":"medium","strength":"primary"},{"type":"mitigates","to":"security/ransomware","why":{"en":"Cutting infected machines off quickly stops the lock-up from spreading to more systems.","da":"Når ramte maskiner hurtigt kobles fra, stoppes låsningen i at sprede sig til flere systemer."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"security/security-incident","confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/runbook","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/observability","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/indicator-of-compromise","why":{"en":"Responders search systems for known traces to find out how far an attack has spread.","da":"Dem, der håndterer hændelsen, søger efter kendte spor for at finde ud af, hvor langt et angreb har spredt sig."},"confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://doi.org/10.6028/NIST.SP.800-61r3","tier":"standard","publisher":"NIST"}],"draft":true}