1. Prerequisites
- Web application incident contained and recovered
- Root cause or best current hypothesis documented
- Remediation items tracked
2. Step-by-Step Instructions
-
Review Root Cause
- Document exploited weakness, affected endpoint, vulnerable component, configuration issue, or access-control failure.
-
Validate Fixes
- Confirm vulnerable code, dependencies, routes, access controls, secrets, and configuration have been remediated.
-
Harden Application Controls
- Improve input validation, output encoding, authentication, authorisation, session management, rate limits, file upload controls, and error handling.
-
Harden Edge Controls
- Review WAF, CDN, API gateway, bot protection, rate limits, security headers, TLS, and runtime detections.
-
Rotate Secrets
- Rotate exposed or potentially exposed API keys, signing keys, session secrets, database credentials, and service credentials.
-
Reduce Trust and Access
- Remove unnecessary integrations, unused endpoints, test routes, debug features, exposed admin panels, and excessive service account permissions.
-
Improve Logging and Detection
- Ensure logs capture request IDs, user IDs, tenant IDs, source IPs, auth decisions, object access, admin actions, and security errors.
- Add detections for the observed attack and close variants.
-
Validate Effectiveness
- Retest the exploited path and similar paths.
- Confirm scans, tests, and telemetry show no continued exposure or exploitation.
-
Update Documentation
- Update playbooks, runbooks, threat models, test cases, dashboards, and service documentation where required.
3. Post-Action
- Record completed hardening, validation evidence, residual risk, and outstanding actions.
- Track remaining remediation to closure.
- Feed lessons into secure SDLC, threat modeling, detection engineering, and vulnerability management.
Contributor
Jayden Vo GitHub: https://github.com/jayden-vo
Contributed to the Arcana Incident Response Documentation Framework.