Certified: The GIAC GSOM Audio Course

In this episode, we shift into a spaced review that reinforces the complete flow of incident work from start to finish, with special attention on how to do each phase without drifting into guesswork. When learners first hear about incident response, it can sound like a set of separate tasks, like investigate here, contain there, clean up later, and then hold a meeting at the end. In reality, these phases are connected by a single thread, which is evidence-driven decision making under time pressure. Guesswork is what happens when that thread breaks, and it breaks when people confuse suspicion with proof, treat urgency as permission to skip reasoning, or assume that silence means safety. The purpose of a spaced review is to make the core habits feel automatic, so when you are stressed and information is incomplete, you still know how to move from uncertainty to clarity. We will revisit investigation, containment, eradication, recovery, and lessons learned in a way that helps you remember not just definitions, but the logic that links them together.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

Investigation is where truth begins, and the key skill to remember is that you are building a defensible story from evidence rather than chasing every signal you can find. The first thing to recall is that early observations are only clues, and clues can support multiple explanations, so you do not want to fall in love with the first story that seems to fit. Instead, you use hypotheses to propose what might be happening, and you test those hypotheses by looking for evidence that would be expected if they were true, while also searching for evidence that would contradict them. This keeps you moving with direction instead of wandering through logs and alerts. The second thing to recall is that timelines are not optional decoration, because time order exposes contradictions and shows you what happened before what, which is how you separate cause from coincidence. When you ground your investigation in tested hypotheses and a coherent timeline, you reduce guesswork because conclusions must match observable facts rather than intuition.

A practical memory anchor for investigation is the difference between what you know, what you think, and what you need to prove next, even if you never label it that way. What you know should be tied to specific evidence, such as an authentication event, a system change, or a network connection, and you should be able to say where it came from and why it is reliable. What you think is your current hypothesis, which is useful but temporary, and it must remain changeable as new facts arrive. What you need to prove next is the shortest list of high-value questions that will reduce uncertainty fastest, such as which identity is involved, which asset is affected, and what time window matters most. When you keep these categories mentally separate, you avoid the most common investigation failure, which is treating assumptions as facts. You also make it easier for teams to collaborate, because different people can gather different pieces of evidence without arguing about the story too early. This simple separation turns investigation from a chaotic search into a disciplined learning process.

Containment is the phase where you start changing the environment to stop harm from continuing, and the main spaced review idea is proportional, targeted risk reduction. A containment action is not good just because it is strong, because strong actions can cripple business operations, erase evidence, or create new outages that become the dominant crisis. Containment should match what you believe is happening and how confident you are, and it should reduce attacker freedom more than it reduces legitimate business capability. In practice, that often means choosing actions that narrow access and limit spread before choosing actions that shut everything down, especially early when the story is still forming. You also want containment actions to be as reversible as possible, because reversibility lets you act quickly while keeping options open if your understanding changes. The key memory to keep is that containment is part of investigation, because containment decisions should be validated by evidence showing risk actually decreased. When you contain with purpose and feedback, you stop guessing and start controlling the incident.

A useful way to recall containment choices is to think in objectives rather than in specific technical moves, because objectives stay stable even when details vary. One objective is to stop the attacker’s current behavior, such as repeated logins or ongoing access to a system. Another objective is to prevent spread to additional accounts or systems, which often means limiting pathways and privileges. Another objective is to protect the most critical functions so the organization can continue operating, even if in a restricted mode. Another objective is to preserve evidence so you can still determine the root cause and confirm eradication later. When you choose a containment action, you should be able to explain which objective it supports and what trade-off it introduces, such as temporary business disruption or delayed functionality. This objective framing prevents containment from becoming random or emotional, because you are choosing actions that align to a clear goal. When your goal is clear, containment becomes less about drama and more about controlled risk management.

Eradication is the work of removing the attacker’s foothold and the conditions that enabled it, and the key spaced review idea is that eradication must address both, not just the most visible symptom. A common mistake is to delete the obvious artifact or close one entry point and assume the incident is over, when the attacker may have multiple footholds or persistence mechanisms. Another mistake is to focus only on the compromised system and ignore identity issues, permissions, or trust relationships that made movement possible. The most important habit to recall is verification, because verification is the difference between eradication and wishful thinking. You define what you expect to see if the attacker is gone, what you expect not to see, and you confirm those expectations using evidence that is strong and corroborated. Without verification, you might eradicate one problem while leaving the real one untouched, and that leads to repeat compromise. Eradication without verification is guesswork wearing a uniform, and the exam expects you to recognize that.

Recovery is where you restore services and normal operations, and the spaced review idea is controlled reentry rather than rushing to flip everything back on at once. Controlled reentry means you bring functions back in steps, validate stability and security at each step, and keep heightened monitoring in place so you can detect relapse quickly. Recovery should be planned around reentry criteria, which are the conditions that must be true before a system or capability returns, such as secured identities, clean systems, and adequate monitoring. A common failure is restoring a system fast because the business is demanding it, then discovering later that the attacker’s access path still exists. Another failure is restoring functionality but not trust, meaning systems are up, but you cannot confidently say they are clean or protected. Controlled reentry prevents those failures by making recovery a sequence of verified steps. When recovery is phased and monitored, it becomes a disciplined process rather than a hopeful return to normal.

Lessons learned is the phase that turns one incident into many improvements, and the key spaced review idea is that learning must produce owned actions that strengthen every prior phase. Lessons learned is not simply a recap meeting, and it is not a search for someone to blame, because blame reduces honesty and destroys the value of the process. The most useful lessons are evidence-driven, grounded in the timeline, decision points, and actual friction the team experienced, such as missing visibility, unclear ownership, slow approvals, or noisy detection. You then map lessons to phases, so improvements become practical, like better logging for detection, clearer escalation paths for containment, stronger verification steps for eradication, or documented rebuild processes for recovery. The final step is assigning owners and defining outcomes so changes actually happen rather than living as good intentions. This is how you close the loop, because you convert the incident into a stronger response capability. Without this conversion, the organization is likely to repeat the incident or repeat the same response mistakes, which is guesswork at the organizational level.

To help connect these phases in your mind, it is useful to remember that each phase answers a different kind of question and hands off a different kind of output. Investigation answers what happened and what evidence supports that view, and it outputs a timeline, tested hypotheses, and a working scope. Containment answers how to stop further harm right now, and it outputs reduced attacker freedom and a safer environment for deeper work. Eradication answers how to remove the foothold and fix enabling conditions, and it outputs evidence-backed confidence that access has been removed. Recovery answers how to return operations safely, and it outputs restored services with controlled monitoring and clear criteria. Lessons learned answers how to improve the next cycle, and it outputs concrete actions and improved readiness. When you see these handoffs, you stop treating incident response as isolated activities and start treating it as a coherent system. Coherence is what replaces guesswork, because every decision has an input, a reason, and an output you can verify.

Another spaced review point is recognizing the failure patterns that push teams into guessing, so you can avoid them deliberately. One pattern is tunnel vision, where the team commits to one explanation and ignores contradictory evidence, which breaks investigation discipline and contaminates every later decision. Another pattern is data hoarding, where the team collects enormous amounts of information but never converts it into a tested story or a timeline, so they feel busy without becoming clear. Another pattern is premature closure, where containment success is treated as incident resolution, causing eradication and verification to be skipped. Another is rushed recovery, where business pressure overrides controlled reentry, increasing the chance of recurrence. There is also communication drift, where different stakeholders believe different versions of reality, leading to conflicting actions and wasted time. Remembering these patterns is valuable because you can watch for them during an incident and correct course early. When you can name a failure pattern, you can replace it with a disciplined habit, and that is how you keep the response evidence-driven.

It is also important to remember that guesswork often feels like speed, which is why it is tempting, but disciplined work is what actually produces fast outcomes. Guesswork can produce quick decisions, but those decisions often create rework, because you contain the wrong thing, rebuild the wrong system, or miss the real entry point and have to respond again. Evidence-driven work can feel slower in the moment because you are validating, documenting, and coordinating, but it reduces thrashing and prevents repeated mistakes. Timelines prevent you from chasing coincidences, hypotheses prevent you from wandering, verification prevents you from declaring victory too early, and controlled reentry prevents relapse. Each of these habits is a speed multiplier over the life of the incident, even if it feels like a speed limiter in the first few minutes. This is an important mental shift for beginners, because you want to associate discipline with effectiveness, not with bureaucracy. The exam rewards that mindset because it reflects how strong operations actually work under pressure.

To make this spaced review practical in your memory, focus on the idea that every phase has a validation step that keeps you honest. Investigation validates by corroborating evidence and reconciling contradictions in the timeline. Containment validates by observing whether risk signals decline and whether attacker freedom is reduced, not just whether activity appears quieter. Eradication validates through checks that confirm footholds and enabling conditions are removed, not just through the absence of alerts. Recovery validates by phased return, functional testing, and heightened monitoring during reentry. Lessons learned validates by turning observations into owned actions and later confirming those actions were implemented and improved readiness. When you associate each phase with validation, you create a mental guardrail against guesswork. Validation is not perfection, but it is the discipline of checking whether reality matches your belief. That discipline is the core of trustworthy incident work.

In closing, this spaced review is meant to strengthen the full incident response cycle in your mind as a connected set of evidence-driven habits rather than a collection of separate tasks. Investigation uses hypotheses and timelines to produce a defensible story and a focused scope, which prevents early assumptions from becoming false certainty. Containment reduces risk proportionally and verifies that actions actually limited attacker freedom without unnecessarily breaking the business. Eradication removes footholds and enabling conditions, and it relies on verification so you do not confuse quiet with clean. Recovery brings services back through controlled reentry with testing and monitoring so you avoid relapse and preserve trust. Lessons learned converts the incident into improvements with owners and outcomes so the next response is faster, clearer, and more resilient. When these ideas feel automatic, you can operate under pressure without guessing, because every step is tied to evidence, validation, and intentional decision making.