┌─────────────────────────────────────────────────────────────────────────────┐
│                    NIST INCIDENT RESPONSE LIFECYCLE                       │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    PREPARE                                          │   │
│  │  Establish IR plan, policies, training, tools                      │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DETECT                                          │   │
│  │  Monitor, detect, analyse, triage                                 │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    RESPOND                                          │   │
│  │  Contain, eradicate, recover, communicate                          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    RECOVER                                          │   │
│  │  Restore systems, validate, monitor                                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    LESSONS LEARNED                                 │   │
│  │  Review, improve, update                                           │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

# ===================================================================
# MODULE 5, LESSON 6: INCIDENT RESPONSE AND BUSINESS CONTINUITY
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("INCIDENT RESPONSE AND BUSINESS CONTINUITY IN BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: INCIDENT RESPONSE PLAN TEMPLATE
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Incident Response Plan Template")
print("-"*60)

ir_plan = """
--- INCIDENT RESPONSE PLAN ---

1. PURPOSE
   To ensure effective response to cybersecurity incidents.

2. SCOPE
   All systems, data, and personnel.

3. ROLES AND RESPONSIBILITIES
   - Incident Commander: ________________________________
   - Communications Lead: ________________________________
   - Technical Lead: ________________________________
   - Legal Lead: ________________________________
   - Business Unit Lead: ________________________________

4. INCIDENT CLASSIFICATION
   - Level 1: Low Impact (Standard Response)
   - Level 2: Medium Impact (Escalated Response)
   - Level 3: High Impact (Full Incident Response)
   - Level 4: Critical Impact (Crisis Management)

5. RESPONSE PHASES
   1. Preparation
   2. Detection and Analysis
   3. Containment, Eradication, and Recovery
   4. Post-Incident Activity

6. COMMUNICATION
   - Internal: [Team]
   - External: [Regulators, Customers, Media]

7. ESCALATION PROCEDURES
   - Escalate to [Manager] for Level 3 and 4 incidents.

8. TRAINING AND EXERCISES
   - Annual tabletop exercises.
   - Regular security awareness training.

9. PLAN MAINTENANCE
   - Review and update annually.
   - Update after major incidents.
"""

print(ir_plan)

# ----------------------------------------------------------------
# PART B: INCIDENT LOGGING AND TRACKING
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Incident Logging and Tracking")
print("-"*60)

# Simulate incident data
np.random.seed(42)
n_incidents = 50

incident_data = pd.DataFrame({
    'incident_id': range(1, n_incidents + 1),
    'date': [datetime.now() - timedelta(days=np.random.randint(0, 365)) for _ in range(n_incidents)],
    'type': np.random.choice(['Phishing', 'Malware', 'Ransomware', 'DDoS', 'Data Breach', 
                              'Insider Threat', 'Lost Device', 'System Failure'], n_incidents),
    'severity': np.random.choice(['Low', 'Medium', 'High', 'Critical'], n_incidents, p=[0.3, 0.3, 0.25, 0.15]),
    'status': np.random.choice(['Closed', 'Resolved', 'In Progress', 'Open'], n_incidents, p=[0.4, 0.3, 0.2, 0.1]),
    'time_to_detect': np.random.gamma(2, 2, n_incidents).clip(0.1, 12),
    'time_to_respond': np.random.gamma(2, 3, n_incidents).clip(0.1, 24),
    'affected_systems': np.random.choice([1, 2, 3, 4, 5], n_incidents, p=[0.3, 0.3, 0.2, 0.1, 0.1]),
    'customer_impact': np.random.choice([0, 1], n_incidents, p=[0.6, 0.4])
})

print("Incident Data Sample:")
print(incident_data.head())

# Summary
incident_summary = incident_data.groupby('type').agg({
    'incident_id': 'count',
    'severity': lambda x: x.value_counts().index[0],
    'time_to_detect': 'mean',
    'time_to_respond': 'mean'
}).round(2)
incident_summary.columns = ['Count', 'Most Common Severity', 'Avg Time to Detect (hrs)', 'Avg Time to Respond (hrs)']

print("\nIncident Summary:")
print(incident_summary)

# Visualise
fig, axes = plt.subplots(2, 2, figsize=(14, 10))

# Incident Types
ax = axes[0, 0]
type_counts = incident_data['type'].value_counts()
ax.bar(type_counts.index, type_counts.values, color='teal', alpha=0.7)
ax.set_xlabel('Incident Type')
ax.set_ylabel('Count')
ax.set_title('Incidents by Type')
ax.tick_params(axis='x', rotation=45)
ax.grid(True, alpha=0.3)

# Severity Distribution
ax = axes[0, 1]
severity_counts = incident_data['severity'].value_counts()
colors = {'Low': 'green', 'Medium': 'orange', 'High': 'red', 'Critical': 'darkred'}
ax.bar(severity_counts.index, severity_counts.values, 
       color=[colors.get(s, 'gray') for s in severity_counts.index], alpha=0.7)
ax.set_xlabel('Severity')
ax.set_ylabel('Count')
ax.set_title('Incident Severity')
ax.grid(True, alpha=0.3)

# Time to Detect vs Time to Respond
ax = axes[1, 0]
ax.scatter(incident_data['time_to_detect'], incident_data['time_to_respond'], 
           c=incident_data['severity'].astype('category').cat.codes, alpha=0.6, cmap='RdYlGn')
ax.set_xlabel('Time to Detect (hours)')
ax.set_ylabel('Time to Respond (hours)')
ax.set_title('Time to Detect vs Time to Respond')
plt.colorbar(ax.collections[0], ax=ax, label='Severity')

# Customer Impact
ax = axes[1, 1]
impact_by_severity = incident_data.groupby('severity')['customer_impact'].mean() * 100
ax.bar(impact_by_severity.index, impact_by_severity.values, color='red', alpha=0.7)
ax.set_xlabel('Severity')
ax.set_ylabel('Customer Impact (%)')
ax.set_title('Customer Impact by Severity')
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('incident_analytics.png', dpi=300, bbox_inches='tight')
plt.show()
print("Incident analytics visualisation saved as 'incident_analytics.png'")

# ----------------------------------------------------------------
# PART C: TABLETOP EXERCISE SIMULATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Tabletop Exercise Simulation")
print("-"*60)

class TabletopExercise:
    """Simulate a tabletop exercise for incident response."""
    
    def __init__(self, scenario):
        self.scenario = scenario
        self.participants = []
        self.decisions = []
        self.timeline = []
        self.status = 'Ready'
    
    def add_participant(self, name, role):
        """Add a participant to the exercise."""
        self.participants.append({'name': name, 'role': role})
    
    def execute_step(self, step, decision):
        """Execute a step in the exercise."""
        self.decisions.append({
            'step': step,
            'decision': decision,
            'timestamp': datetime.now().isoformat()
        })
        self.timeline.append(step)
    
    def simulate_scenario(self):
        """Simulate a tabletop exercise scenario."""
        self.status = 'In Progress'
        
        steps = [
            'Step 1: Incident detection (phishing email reported)',
            'Step 2: Initial triage and classification',
            'Step 3: Containment (block malicious emails)',
            'Step 4: Investigation (identify affected users)',
            'Step 5: Eradication (remove malware)',
            'Step 6: Recovery (restore systems)',
            'Step 7: Notification (internal and external)',
            'Step 8: Lessons learned'
        ]
        
        # Simulate decisions
        decisions = [
            'Incident classified as Medium severity',
            'Containment: Block phishing emails, reset passwords',
            'Investigation: 5 users affected, no data breach',
            'Eradication: Malware removed from affected systems',
            'Recovery: Systems restored from backup',
            'Notification: Internal only',
            'Lessons learned: Increase phishing awareness training'
        ]
        
        for step, decision in zip(steps, decisions):
            self.execute_step(step, decision)
        
        self.status = 'Completed'
        return self.decisions

# Create and run exercise
print("Simulating Tabletop Exercise...")
exercise = TabletopExercise('Phishing Attack on Employees')

# Add participants
exercise.add_participant('Alice', 'Incident Commander')
exercise.add_participant('Bob', 'Technical Lead')
exercise.add_participant('Charlie', 'Communications Lead')
exercise.add_participant('Diana', 'Legal Lead')

# Run exercise
results = exercise.simulate_scenario()

print("Tabletop Exercise Results:")
for result in results:
    print(f"  {result['step']}")
    print(f"    Decision: {result['decision']}")

print(f"\nExercise Status: {exercise.status}")
print(f"Participants: {[p['name'] for p in exercise.participants]}")

# ----------------------------------------------------------------
# PART D: BUSINESS CONTINUITY PLANNING
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Business Continuity Planning")
print("-"*60)

# Define critical business functions
critical_functions = pd.DataFrame({
    'Function': [
        'Online Banking',
        'Mobile Banking',
        'Transaction Processing',
        'Customer Service',
        'ATM Network',
        'Card Payments',
        'Loan Origination',
        'Fraud Detection'
    ],
    'RTO (hours)': [2, 2, 4, 8, 4, 4, 8, 4],
    'RPO (minutes)': [15, 15, 30, 60, 30, 30, 60, 30],
    'Current Capability': ['4 hours', '4 hours', '6 hours', '12 hours', '6 hours', '6 hours', '12 hours', '6 hours'],
    'Status': ['🔴', '🔴', '🟡', '🟡', '🟡', '🟡', '🟡', '🟡']
})

print("Business Continuity Planning:")
print(critical_functions.to_string(index=False))

# ----------------------------------------------------------------
# PART E: INCIDENT RESPONSE METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Incident Response Metrics")
print("-"*60)

ir_metrics = pd.DataFrame({
    'Metric': [
        'Mean Time to Detect (MTTD)',
        'Mean Time to Respond (MTTR)',
        'Mean Time to Contain (MTTC)',
        'Mean Time to Recover (MTTR)',
        'Incident Closure Rate',
        'Critical Incident Rate',
        'Customer Impact Rate',
        'IR Plan Test Frequency'
    ],
    'Current Value': [
        '4.2 hours',
        '6.5 hours',
        '3.8 hours',
        '8.2 hours',
        '85%',
        '15%',
        '40%',
        'Annually'
    ],
    'Target Value': [
        '< 1 hour',
        '< 2 hours',
        '< 1 hour',
        '< 4 hours',
        '> 95%',
        '< 5%',
        '< 10%',
        'Semi-annually'
    ],
    'Status': ['🔴', '🔴', '🔴', '🔴', '🟡', '🟡', '🔴', '🟡']
})

print("Incident Response Metrics:")
print(ir_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART F: INCIDENT RESPONSE ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Incident Response Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Establish incident response foundation.",
        "Activities": [
            "Develop IR plan and playbooks.",
            "Establish IR team and roles.",
            "Implement security monitoring and alerting.",
            "Conduct initial tabletop exercise."
        ],
        "Success Metrics": ["IR plan documented", "MTTD < 4 hours"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale incident response capabilities.",
        "Activities": [
            "Implement SIEM and SOAR.",
            "Automate detection and response.",
            "Establish threat intelligence.",
            "Conduct regular tabletop exercises."
        ],
        "Success Metrics": ["MTTD < 2 hours", "MTTR < 4 hours"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced incident response.",
        "Activities": [
            "Implement AI-powered threat detection.",
            "Deploy automated response.",
            "Build threat hunting capabilities.",
            "Achieve industry-leading IR."
        ],
        "Success Metrics": ["MTTD < 1 hour", "MTTR < 2 hours"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading incident response.",
        "Activities": [
            "Implement predictive analytics.",
            "Build autonomous response.",
            "Achieve industry leadership.",
            "Establish IR culture."
        ],
        "Success Metrics": ["Industry-leading IR", "Continuous improvement"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Incident Response and Business Continuity – Key Takeaways:

1. Incident response is critical for managing cybersecurity incidents.
2. NIST framework: Prepare → Detect → Respond → Recover → Lessons Learned.
3. Incident response roles: Incident Commander, Communications, Technical, Legal, Business.
4. Business continuity planning: BIA, recovery strategies, testing, communication.
5. Key metrics: MTTD, MTTR, incident closure rate, customer impact.
6. Regulatory requirements: GDPR (72 hours), NYDFS (24 hours), PCI DSS.
7. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Develop and maintain an incident response plan.
  - Conduct regular tabletop exercises.
  - Implement security monitoring and alerting.
  - Define and track IR metrics.
  - Ensure regulatory compliance with incident reporting.
  - Continuously improve incident response capabilities.
""")

print("="*70)
print("END OF LESSON 6 – MODULE 5")
print("="*70)