Backend Incident Response — Security Incident Response for Backend Applications

// Incident response automation
class IncidentResponder {
  constructor() {
    this.playbooks = new Map();
  }

  registerPlaybook(incidentType, playbook) {
    this.playbooks.set(incidentType, playbook);
  }

  async handleIncident(incident) {
    const playbook = this.playbooks.get(incident.type);
    if (!playbook) throw new Error(`No playbook for incident type: ${incident.type}`);

    logger.warn('Incident detected', { type: incident.type, severity: incident.severity });

    // Instant response actions
    await this.containIncident(incident);

    // Execute playbook
    await playbook.execute(incident);

    // Log and notify
    await this.documentIncident(incident);
    await this.notifyTeam(incident);
  }

  async containIncident(incident) {
    switch (incident.type) {
      case 'compromised_credential':
        // Revoke all tokens for affected user
        await authService.revokeAllTokens(incident.userId);
        // Force password reset
        await authService.forcePasswordReset(incident.userId);
        // Add to watchlist
        await redis.sadd('compromised_users', incident.userId);
        break;

      case 'data_breach':
        // Block affected API keys
        for (const key of incident.affectedKeys || []) {
          await apiKeyManager.deactivateKey(key);
        }
        // Enable additional logging
        await this.enableAuditMode();
        break;

      case 'dos_attack':
        // Enable strict rate limiting
        await rateLimiter.enforceStrictMode();
        // Block source IPs
        for (const ip of incident.sourceIPs || []) {
          await redis.setex(`blocked:${ip}`, 86400, 'true');
        }
        break;

      case 'supply_chain':
        // Quarantine affected service
        await this.quarantineService(incident.serviceName);
        break;
    }
  }

  async quarantineService(serviceName) {
    // Remove from service mesh
    await serviceMesh.removeService(serviceName);
    // Revoke service tokens
    await redis.del(`service:${serviceName}:token`);
    logger.warn('Service quarantined', { service: serviceName });
  }

  async documentIncident(incident) {
    const incidentRecord = {
      ...incident,
      documentedAt: new Date().toISOString(),
      responder: config.serviceName,
      containmentActions: []
    };

    await db.incidents.insert(incidentRecord);
  }

  async notifyTeam(incident) {
    const channels = incident.severity === 'critical' ? ['pagerduty', 'slack'] : ['slack'];
    for (const channel of channels) {
      await alertService.send({ channel, incident });
    }
  }
}

// Example playbook
const credentialCompromisePlaybook = {
  execute: async (incident) => {
    // 1. Revoke credentials
    // 2. Audit recent activity
    // 3. Notify affected user
    // 4. Scan for further compromise
    // 5. Update threat intel
    // 6. Post-mortem within 48 hours
  }
};