Security Incident Post-Mortem

Template Overview

Information security incidents require exhaustive, blameless post-mortem investigations to discover root causes, evaluate perimeter vulnerabilities, and install permanent preventative guardrails. The Security Incident Post-Mortem template provides an unyielding technical framework to dissect security incidents without blame.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Security Post-Mortem: [SEC-XXXX]"
date: [YYYY-MM-DD]
incident_id: "[SEC-XXXX]"
ciso: "[[Chief Information Security Officer]]"
lead_investigator: "[[Lead Security Engineer]]"
severity: "Sev-1 / Security Alert"
attack_vector: "[Credential Stuffing / Zero-Day / Misconfiguration]"
customer_data_impact: "None Confirmed"
tags: [security, infosec, post-mortem, incident-response, devops]
---

# Security Incident Post-Mortem — [SEC-XXXX]

## 1. Executive Summary & Impact Assessment
- **Incident Overview:** Unauthorized API credential enumeration attempt detected against public auth endpoint.
- **Duration:** 42 minutes from initial anomalous payload to automated IP block enforcement.
- **Data Integrity:** Database integrity checks confirm zero unauthorized record reads or egress.

## 2. Detailed Technical Timeline
- **11:04 UTC:** Ingress firewall flagged abnormal spike in HTTP 401 Unauthorized responses.
- **11:15 UTC:** On-call engineer confirmed distributed credential spraying pattern from rotating ASNs.
- **11:28 UTC:** Rate limiter emergency rule deployed; malicious IP ranges throttled to zero bandwidth.
- **11:46 UTC:** All active session tokens for impacted account IDs revoked and re-issued.

## 3. Five Whys Root Cause Analysis
1. *Why was the credential spray not blocked immediately?* The legacy rate limiter only inspected single IP addresses rather than ASN clusters.
2. *Why was ASN-level rate limiting absent?* Ingress proxy configurations had not been updated following the last edge router migration.
3. *Why was the edge router migration missing this check?* Pre-flight checklist did not include multi-vector DDoS verification scripts.

## 4. Preventative Corrective Actions
- [ ] [[Lead Security Engineer]] Implement ASN-level and fingerprint-based rate limiting across all edge endpoints.
- [ ] [[DevOps Lead]] Add automated DDoS simulation suite to CI/CD release verification pipeline.
- [ ] [[Compliance Lead]] Update security audit documentation for annual SOC 2 Type II assessment.

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Security Post-Mortem: SEC-2026-09"
date: 2026-10-09
incident_id: "SEC-2026-09"
ciso: "[[Evelyn Reed]]"
lead_investigator: "[[Tarek Mansour]]"
severity: "Sev-1"
attack_vector: "API Key Header Injection Attempt"
customer_data_impact: "None"
tags: [security, infosec, post-mortem, incident-response]
---

# Security Incident Post-Mortem — SEC-2026-09

## 1. Executive Summary
Tarek Mansour reviewed the anomalous packet sequence detected on October 8. An external scanner attempted header injection against the webhook ingress listener. The payload was safely dropped by the strict schema validator.

## 2. Root Cause Analysis
The investigation confirmed that while all payloads were blocked, the endpoint failed to trigger an automated security alert until 15 minutes into the scan due to an alert threshold misconfiguration.

## 3. Corrective Measures
Evelyn Reed approved reducing the anomaly alert threshold from 500 dropped packets to 50 dropped packets across any 60-second sliding window.

When to Use and When to Avoid

When to Use

• Use following any verified security breach, unauthorized access attempt, or severe vulnerability disclosure.
• Use to establish systemic technical remediations and eliminate recurrence of security weaknesses.
• Use to produce auditable documentation for corporate risk officers and insurance underwriters.

When to Avoid

• Avoid using for operational service outages with zero security component (use infrastructure post-mortems).
• Avoid using as a venue for disciplinary blame (keep post-mortems strictly focused on systems and code).

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Analyze the security post-mortem audio recording:
1. Synthesize the chronological sequence of the attack vector, detection trigger, and mitigation actions.
2. Document the Five Whys root cause analysis chain verbatim.
3. Extract all preventative technical guardrails with engineering owners and target deployment dates.
Output in clean, structured Markdown.

Your data remains securely on your Mac with zero cloud exposure.