The First 24 Hours: A CTO’s Step-by-Step Data Breach Incident Response Playbook

The moment unauthorized access, data exfiltration, or anomalous lateral movement is detected, panic is the enemy. Well-meaning engineers often reboot servers or run cleanup scripts, destroying critical in-memory volatile artifacts needed by law enforcement and cyber insurance examiners.

Containment must occur at the virtualization or firewall perimeter: isolate the affected instance by severing its network security groups while maintaining continuous power to preserve active cryptographic keys, network sockets, and loaded malware payloads.

Before halting the system or touching the file system, execute an automated volatile memory acquisition script over a dedicated, isolated forensic VLAN or direct out-of-band management console.

Capture live process listings, active TCP/UDP connections, loaded kernel modules, and environment variables into an immutable, cryptographically hashed forensic image.

#!/usr/bin/env bash
# NATELAD EMERGENCY INCIDENT RESPONSE - LIVE VOLATILE MEMORY DUMP
set -euo pipefail

TARGET_HOST="app-db-worker-01"
FORENSIC_BUCKET="s3://natelad-ir-vault-isolated/case-2026-0929"
TIMESTAMP=$(date -u +"%Y%m%dT%H%M%SZ")

echo "[!] Initiating volatile artifact acquisition for: $TARGET_HOST"

# 1. Capture volatile network sockets and established foreign connections
ss -tupna > "/tmp/volatile_sockets_${TIMESTAMP}.txt"
lsof -i -P -n >> "/tmp/volatile_sockets_${TIMESTAMP}.txt"

# 2. Acquire memory with LiME (Linux Memory Extractor) without paging out
insmod /opt/forensics/lime.ko "path=/tmp/memory_${TIMESTAMP}.lime format=raw"

# 3. Cryptographically seal forensic evidence with SHA-256
sha256sum "/tmp/memory_${TIMESTAMP}.lime" > "/tmp/memory_${TIMESTAMP}.lime.sha256"

# 4. Stream directly to write-once WORM-locked S3 compliance vault
aws s3 cp "/tmp/memory_${TIMESTAMP}.lime" "${FORENSIC_BUCKET}/" --storage-class GLACIER_IR
aws s3 cp "/tmp/memory_${TIMESTAMP}.lime.sha256" "${FORENSIC_BUCKET}/"

echo "[✓] Forensic memory sealed and uploaded to write-locked vault."

Never attempt to disinfect a compromised operating system. Once root or lateral movement is confirmed, the operating environment is irrecoverably tainted.

Rebuild the entire infrastructure stack from audited Infrastructure-as-Code (Terraform/Ansible) templates, rotate all database master credentials and API tokens, purge all issued user JWT sessions, and re-enable public traffic only after regression scanning.