OWASP SCS Incident Response Handbook¶
OWASP Smart Contract Security Project
Part of the OWASP SCS Handbook Series. Built to the series conventions.
Purpose and Scope¶
This handbook prepares security teams, protocol operators, and incident responders to detect, contain, and recover from security incidents that hit smart contracts, protocols, infrastructure, and the people who run them. It follows the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 3 model, aligned to the Cybersecurity Framework (CSF) 2.0 Community Profile: incident response as a continuous cycle across Govern, Identify, Protect, Detect, Respond, and Recover, not a document that only gets opened once an alert fires. Supplemental NIST guidance on log management (SP 800-92 Rev. 1), event recovery (SP 800-184), and threat information sharing (SP 800-150) fills in implementation detail the core publication leaves to the reader.
The handbook works through communication strategy (who talks to whom, when, and on which channel), detection and response mechanics (on-chain monitoring, triage, evidence collection, containment), and a library of incident-specific playbooks: smart contract and protocol hacks, wallet drainer and phishing campaigns, malware and compromised endpoints, insider threats and nation-state-style attacks including vectors attributed to the Democratic People's Republic of Korea (DPRK), and the coordination patterns unique to decentralized teams with no single incident commander. It closes with the lessons-learned loop that feeds fixes back into playbooks and detection rules, because an incident response plan that never changes after an incident is not really a plan.
Target Audience¶
Security specialists, operations and strategy leads, DevOps and site reliability engineering (SRE) staff, protocol teams, and anyone holding incident response or crisis coordination duties inside a Web3 organization.
How to Use This Handbook¶
Start with Part I to fix the incident response lifecycle, team roles, and how this handbook maps to the SCS verification and testing standards. Part II sets the internal and external communication rules that hold regardless of incident type. Part III is the operational core: detection sources, triage, evidence collection, and containment mechanics. Part IV is the playbook library, one chapter per incident type, from a live protocol hack to an insider threat; pull the matching playbook the moment an incident is declared. Part V closes the loop with post-incident review and continuous improvement, and the appendices hold the glossary, severity matrix, tool list, and message templates a responder needs mid-incident. A team already mid-incident should skip straight to Part IV and the templates in Appendix D.
Relationship to SCSVS, SCSTG, and SCWE¶
This handbook complements the OWASP smart contract standards rather than duplicating them. The Smart Contract Security Verification Standard (SCSVS) defines the controls a system must satisfy before an incident; the detection, monitoring, and evidence-collection requirements here are the operational counterpart for the moment one of those controls fails anyway. The Smart Contract Security Testing Guide (SCSTG) describes how to test for weaknesses before deployment; the playbooks in Part IV describe what to do when a weakness the testing guide catalogs gets exploited in production instead. The Smart Contract Weakness Enumeration (SCWE) names the root-cause weakness classes; this handbook's job starts at the moment one of those classes turns into a live incident. The EVM Forensics and DeFi Recovery Handbook (04) picks up the post-incident chain analysis and fund-recovery work referenced throughout the playbooks here, and the Web3 Attack Vectors Mapping Handbook (10) supplies the WA01 to WA15 taxonomy used to classify an incident once it has been triaged.
Contents¶
Part I: Foundations - 1. Introduction to Incident Management - 2. Incident Response Lifecycle - 3. Roles and Responsibilities
Part II: Communication Strategies - 4. Communication During Incidents
Part III: Detection and Response - 5. Incident Detection - 6. Incident Response Procedures - 7. Preparation Checklist
Part IV: Playbooks - 8. Playbook Overview - 9. Smart Contract and Protocol Hack - 10. Wallet Drainer and Phishing Incidents - 11. Malware and Compromised Endpoints - 12. Insider and Nation-State-Style Attacks (e.g., DPRK Vectors) - 13. Decentralized Incident Response - 14. War Room and Crisis Coordination - 15. Safe Harbor and Whitehat Recovery - 16. Vulnerability Disclosure and Bug Bounty Linkage
Part V: Lessons Learned and Improvement - 17. Lessons Learned - 18. Continuous Improvement
Part VI: Appendices - 19. Appendix A: Glossary - 20. Appendix B: Severity and Triage Matrix - 21. Appendix C: Suggested Tools and Platforms - 22. Appendix D: Message and Communication Templates - 23. Appendix E: References and Further Reading