# Incident Response Playbook

## Overview

This playbook describes the steps for detecting, containing and recovering from security incidents on the Noveu platform.

## Incident Taxonomy

### Categories

| Category | Examples | Typical Severity |
|-----------|-------------|-------------------|
| **Malware** | Ransomware, trojans, viruses | Sev1-2 |
| **Unauthorised Access** | Credential theft, privilege escalation | Sev1-2 |
| **Data Breach** | Exfiltration, unauthorised disclosure | Sev1 |
| **DDoS** | Volumetric, application layer | Sev2-3 |
| **Phishing** | Credential harvesting, BEC | Sev2-3 |
| **Insider Threat** | Data theft, sabotage | Sev1-2 |
| **Misconfiguration** | Exposed data, weak controls | Sev2-3 |

### Determining Severity

```
                        ┌─────────────────────────────┐
                        │     IMPACT ASSESSMENT       │
                        └─────────────────────────────┘
                                     │
            ┌────────────────────────┼────────────────────────┐
            ▼                        ▼                        ▼
     ┌───────────┐            ┌───────────┐            ┌───────────┐
     │ How many  │            │ Which     │            │ Reputation│
     │ systems?  │            │ data?     │            │ damage?   │
     └───────────┘            └───────────┘            └───────────┘
            │                        │                        │
            ▼                        ▼                        ▼
     All: Sev1               Sensitive: Sev1          Public: Sev1
     Multiple: Sev2          Internal: Sev2           Limited: Sev2
     Single: Sev3            Public: Sev3             None: Sev3
```

## Response Phases

### Phase 1: Detection and Analysis (0-30 min)

**Goal**: Validate the incident and determine the scope

#### Steps

1. **Alert triage**
   - [ ] Alert received from monitoring (Prometheus and Alertmanager)
   - [ ] Rule out a false positive
   - [ ] Determine the severity

2. **Initial analysis**
   - [ ] Identify affected systems
   - [ ] Determine the attack vector
   - [ ] Reconstruct the timeline
   - [ ] Collect IOCs

3. **Communication**
   - [ ] Appoint an Incident Commander
   - [ ] Open a war room (virtual/physical)
   - [ ] Notify stakeholders

#### Documentation

```markdown
## Incident Report: [INCIDENT-ID]

**Detected**: [timestamp]
**Reported by**: [name/system]
**Severity**: [1-4]
**Status**: [Open/In Progress/Resolved]

### Description
[Short description of the incident]

### Affected Systems
- [System 1]
- [System 2]

### Initial IOCs
- IP: [...]
- Hash: [...]
- Domain: [...]
```

### Phase 2: Containment (30 min to 2 hours)

**Goal**: Prevent further damage

#### Short-term containment

| Action | When | Risk |
|-------|---------|--------|
| Account lockout | Compromised credentials | User impact |
| Network isolation | Active breach | Service impact |
| Process kill | Malware active | Data loss |
| Block IOCs | Ongoing attack | False positives |

#### Long-term containment

| Action | Description |
|-------|--------------|
| Segment network | Isolate the affected segment |
| Revoke credentials | All potentially compromised ones |
| Increase logging | More detail on suspicious systems |
| Enable additional controls | MFA, DLP, etc. |

#### Decision tree

```
Is the attack still active?
├── YES → Immediate isolation
│        ├── Critical system? → Failover first
│        └── Non-critical? → Isolate directly
└── NO → Controlled containment
          ├── Identify all entry points
          └── Close them one by one
```

### Phase 3: Eradication (2-24 hours)

**Goal**: Remove the threat completely

#### Clean-up Steps

1. **System remediation**
   - [ ] Remove malware
   - [ ] Close backdoors
   - [ ] Patch vulnerabilities
   - [ ] Restore the configuration

2. **Credential hygiene**
   - [ ] Enforce password resets
   - [ ] Rotate API keys
   - [ ] Reissue certificates
   - [ ] Re-enrol MFA

3. **Evidence preservation**
   - [ ] Create forensic images
   - [ ] Export logs
   - [ ] Document the chain of custody

### Phase 4: Recovery (24 hours to 1 week)

**Goal**: Safe return to normal operation

#### Recovery plan

| Step | Action | Verification |
|------|-------|-------------|
| 1 | System rebuild/restore | Integrity check |
| 2 | Validate security controls | Config review |
| 3 | Increase monitoring | Alert thresholds |
| 4 | Phased reactivation | Smoke tests |
| 5 | Restore user access | Access audit |

#### Go-Live Checklist

- [ ] All IOCs blocked
- [ ] Vulnerabilities patched
- [ ] Credentials rotated
- [ ] Monitoring active
- [ ] Backup validated
- [ ] Stakeholders informed

### Phase 5: Post-Incident (1-4 weeks)

**Goal**: Learn and improve

#### Post-Mortem

```markdown
## Post-Incident Review

**Incident**: [ID]
**Review date**: [...]
**Participants**: [...]

### Timeline
[Chronological reconstruction]

### Root Cause
[Technical and process cause]

### What Went Well
- [...]

### What Could Improve
- [...]

### Action Items
| Item | Owner | Deadline | Status |
|------|-------|----------|--------|
| [...] | [...] | [...] | [...] |
```

## Reporting obligation

### Internal Notification

| Severity | Who | When |
|-------|-----|---------|
| Sev1 | Management + Security + Legal | Immediately |
| Sev2 | Security + Account team | With priority |
| Sev3 | Security | On working days |
| Sev4 | Ticket system | < 1 working day |

### External Notification

#### Authorities (in case of a data breach)

| Authority | Deadline | Criterion |
|------------|---------|-----------|
| Autoriteit Persoonsgegevens | 72 hours | Personal data leaked |
| NIS2 authority | 24 hours | Significant incident |
| Police | As soon as possible | In case of crime |

#### Customers

| Severity | Notification |
|-------|-------------|
| Sev1 with customer impact | Immediately |
| Sev2 with customer data | Without undue delay, within 48 hours at the latest (art. 7 of the data processing agreement) |
| Sev3 relevant | Post-incident report |

### Customer Notification Template

```
Subject: Security Incident Notification: [Short description]

Dear [Customer],

On [date] we detected a security incident that [impact description].

What happened:
[Description]

Which measures have been taken:
[Actions]

What this means for you:
[Impact and recommendations]

Next steps:
[What we will do]

For questions, please contact [contact].

Kind regards,
[Incident coordinator of your organisation]
```

## Contacts

You report a vulnerability at Noveu via security@noveu.eu. For a question or incident, open a support ticket in the customer portal or email support@noveu.eu. Response times are in the [SLA](https://noveu.eu/en/legal/sla).

### Internal contact list for your organisation

Fill in the contact persons of your own organisation below.

| Role | Contact | Availability |
|-----|---------|----------------|
| Security Lead | [name] | [internal contact channel] |
| CTO | [name] | Escalation |
| Legal | [name] | Working days |

### External

| Party | Type | Contact |
|--------|------|---------|
| Autoriteit Persoonsgegevens | Supervisory authority | meldplicht@autoriteitpersoonsgegevens.nl |
| NCSC | Security | cert@ncsc.nl |
| Forensic Partner | Investigation | [partner] |
| Legal Counsel | Legal | [lawyer] |

---

*Review: every year or after a major incident*