Incident response: playbook for security incidents

Overview

This playbook describes the steps for detecting, containing and recovering from security incidents on the Noveu platform.

Incident Taxonomy

Category	Examples	Typical Severity
Malware	Ransomware, trojans, viruses	Sev1-2
Unauthorised Access	Credential theft, privilege escalation	Sev1-2
Data Breach	Exfiltration, unauthorised disclosure	Sev1
DDoS	Volumetric, application layer	Sev2-3
Phishing	Credential harvesting, BEC	Sev2-3
Insider Threat	Data theft, sabotage	Sev1-2
Misconfiguration	Exposed data, weak controls	Sev2-3

Determining Severity

                        ┌─────────────────────────────┐
                        │     IMPACT ASSESSMENT       │
                        └─────────────────────────────┘
                                     │
            ┌────────────────────────┼────────────────────────┐
            ▼                        ▼                        ▼
     ┌───────────┐            ┌───────────┐            ┌───────────┐
     │ How many  │            │ Which     │            │ Reputation│
     │ systems?  │            │ data?     │            │ damage?   │
     └───────────┘            └───────────┘            └───────────┘
            │                        │                        │
            ▼                        ▼                        ▼
     All: Sev1               Sensitive: Sev1          Public: Sev1
     Multiple: Sev2          Internal: Sev2           Limited: Sev2
     Single: Sev3            Public: Sev3             None: Sev3

Response Phases

Phase 1: Detection and Analysis (0-30 min)

Goal: Validate the incident and determine the scope

Steps

Alert triage
- Alert received from monitoring (Prometheus and Alertmanager)
- Rule out a false positive
- Determine the severity
Initial analysis
- Identify affected systems
- Determine the attack vector
- Reconstruct the timeline
- Collect IOCs
Communication
- Appoint an Incident Commander
- Open a war room (virtual/physical)
- Notify stakeholders

Documentation

## Incident Report: [INCIDENT-ID]

**Detected**: [timestamp]
**Reported by**: [name/system]
**Severity**: [1-4]
**Status**: [Open/In Progress/Resolved]

### Description
[Short description of the incident]

### Affected Systems
- [System 1]
- [System 2]

### Initial IOCs
- IP: [...]
- Hash: [...]
- Domain: [...]

Phase 2: Containment (30 min to 2 hours)

Goal: Prevent further damage

Short-term containment

Action	When	Risk
Account lockout	Compromised credentials	User impact
Network isolation	Active breach	Service impact
Process kill	Malware active	Data loss
Block IOCs	Ongoing attack	False positives

Long-term containment

Action	Description
Segment network	Isolate the affected segment
Revoke credentials	All potentially compromised ones
Increase logging	More detail on suspicious systems
Enable additional controls	MFA, DLP, etc.

Decision tree

Is the attack still active?
├── YES → Immediate isolation
│        ├── Critical system? → Failover first
│        └── Non-critical? → Isolate directly
└── NO → Controlled containment
          ├── Identify all entry points
          └── Close them one by one

Phase 3: Eradication (2-24 hours)

Goal: Remove the threat completely

Clean-up Steps

System remediation
- Remove malware
- Close backdoors
- Patch vulnerabilities
- Restore the configuration
Credential hygiene
- Enforce password resets
- Rotate API keys
- Reissue certificates
- Re-enrol MFA
Evidence preservation
- Create forensic images
- Export logs
- Document the chain of custody

Phase 4: Recovery (24 hours to 1 week)

Goal: Safe return to normal operation

Recovery plan

Step	Action	Verification
1	System rebuild/restore	Integrity check
2	Validate security controls	Config review
3	Increase monitoring	Alert thresholds
4	Phased reactivation	Smoke tests
5	Restore user access	Access audit

Go-Live Checklist

Phase 5: Post-Incident (1-4 weeks)

Goal: Learn and improve

Post-Mortem

## Post-Incident Review

**Incident**: [ID]
**Review date**: [...]
**Participants**: [...]

### Timeline
[Chronological reconstruction]

### Root Cause
[Technical and process cause]

### What Went Well
- [...]

### What Could Improve
- [...]

### Action Items
| Item | Owner | Deadline | Status |
|------|-------|----------|--------|
| [...] | [...] | [...] | [...] |

Reporting obligation

Internal Notification

Severity	Who	When
Sev1	Management + Security + Legal	Immediately
Sev2	Security + Account team	With priority
Sev3	Security	On working days
Sev4	Ticket system	< 1 working day

External Notification

Authorities (in case of a data breach)

Authority	Deadline	Criterion
Autoriteit Persoonsgegevens	72 hours	Personal data leaked
NIS2 authority	24 hours	Significant incident
Police	As soon as possible	In case of crime

Customers

Severity	Notification
Sev1 with customer impact	Immediately
Sev2 with customer data	Without undue delay, within 48 hours at the latest (art. 7 of the data processing agreement)
Sev3 relevant	Post-incident report

Customer Notification Template

Subject: Security Incident Notification: [Short description]

Dear [Customer],

On [date] we detected a security incident that [impact description].

What happened:
[Description]

Which measures have been taken:
[Actions]

What this means for you:
[Impact and recommendations]

Next steps:
[What we will do]

For questions, please contact [contact].

Kind regards,
[Incident coordinator of your organisation]

Contacts

You report a vulnerability at Noveu via security@noveu.eu. For a question or incident, open a support ticket in the customer portal or email support@noveu.eu. Response times are in the SLA.

Internal contact list for your organisation

Fill in the contact persons of your own organisation below.

Role	Contact	Availability
Security Lead	[name]	[internal contact channel]
CTO	[name]	Escalation
Legal	[name]	Working days

External

Party	Type	Contact
Autoriteit Persoonsgegevens	Supervisory authority	meldplicht@autoriteitpersoonsgegevens.nl
NCSC	Security	cert@ncsc.nl
Forensic Partner	Investigation	[partner]
Legal Counsel	Legal	[lawyer]

Review: every year or after a major incident

Incident Response Playbook