What is incident response?
An incident is any event that breaks security policy, the acceptable use policy (AUP) or the law, or that threatens the confidentiality, integrity or availability of systems and data. Examples a technician might run into: ransomware on a workstation, signs that someone is copying company files to a personal cloud account, an unencrypted laptop full of patient or card data left in a taxi, or illegal images found during a repair. Larger organizations keep a written incident response plan and a team to run it, often called the security team or CSIRT (computer security incident response team). At the A+ level your job is first response: recognize the incident, hand it to the right people and avoid destroying evidence.
First-response steps for a technician
- Identify. Recognize that something is wrong and note what you saw, where and when. Then stop exploring. Do not open more files, copy anything or delete anything.
- Report through proper channels. Tell your supervisor, the security team or the contact named in the incident response policy. HR, legal or compliance get involved when the policy says so. Do not discuss it with coworkers, post about it or confront the person you suspect.
- Preserve the data and the device. Leave the system as it is unless the policy says otherwise. Isolating it from the network, by unplugging the cable or turning off Wi-Fi, can stop ongoing damage without wiping memory, while powering it off loses everything in RAM. Lock the device away so no one else can touch it.
- Document. Record who, what, when, where and how as events happen, including any change you had to make, such as unplugging a cable. When evidence changes hands, a chain of custody record tracks it.
Contacting law enforcement is a decision for management and legal staff, not the individual technician. Some content, such as child sexual abuse material, can carry legal reporting obligations, and the organization's policy says who handles them.
The larger response cycle
Security teams commonly describe incident response as a cycle: preparation, detection and analysis, containment, eradication, recovery, and a post-incident review (lessons learned) that improves the plan. A+ technicians mainly work at the front of that cycle, detecting and reporting, and sometimes help with cleanup and restoration later under direction.
Malware incidents and the removal procedure
Malware is the incident a technician handles most often, and the A+ malware removal procedure follows the same logic: investigate and confirm the symptoms, quarantine the infected system by disconnecting it from the network, turn off System Restore so infected restore points are not reused, remediate by updating anti-malware tools and scanning (from safe mode or a preinstallation environment if needed), schedule scans and apply updates, turn System Restore back on and create a fresh restore point, then educate the user. If an infection involves data theft, regulated data or anything else the policy treats as a security incident, report it before cleaning, because cleanup can destroy evidence.
Incident response vs everyday troubleshooting
Normal troubleshooting rewards trying things: reboot, reinstall, delete the bad file. During an incident, those same habits change timestamps, overwrite deleted data and can expose you to legal risk. If you find illegal content, a ransom note or data leaving the network, think "stop, report, preserve," not "fix it now."
Incident response on the CompTIA A+ exam
Core 2 (220-1202) objective 4.6 covers handling prohibited content and incidents, and objective 2.6 covers the malware removal procedure. Expect scenarios where a technician discovers something during routine work. The correct answer usually reports it through proper channels, preserves the device and data and documents what happened. Wrong answers include deleting the files, confronting the user, wiping the drive, calling the police yourself or telling coworkers. For an infected PC, the first action after confirming symptoms is to quarantine it from the network.