<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-root-cause-analysis
description: >-
  Conduct structured root cause analysis using 5 Whys, Ishikawa diagrams,
  and Fault Tree Analysis to identify underlying causes of security incidents
  and drive systemic remediation rather than symptom-level fixes.
domain: cybersecurity
subdomain: incident-management
tags:
  - root-cause-analysis
  - 5-whys
  - ishikawa
  - fault-tree
  - post-incident
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0001", "TA0003", "TA0005"]
  nist-csf: ["RS.AN-1", "RS.IM-1"]
  frameworks: ["NIST SP 800-61", "ITIL Problem Management"]
---

# Performing Root Cause Analysis

## Overview

Root cause analysis (RCA) moves beyond the immediate technical failure to
identify systemic conditions that allowed the incident to occur. Effective
RCA produces actionable remediation that prevents recurrence.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Incident timeline | Sequence of events for analysis |
| Log evidence | Supporting data for causal claims |
| Subject matter experts | Domain knowledge for each system |
| RCA template | Structured output format |

## Methods

### 5 Whys

```
INCIDENT: Attacker exfiltrated customer database

WHY 1: How did the attacker access the database?
→ SQL injection in the customer search API

WHY 2: Why was SQL injection possible?
→ Input parameters were not parameterized

WHY 3: Why were queries not parameterized?
→ Developer used raw SQL to bypass ORM performance issue

WHY 4: Why was the raw SQL not caught in review?
→ No SAST rule for raw SQL usage; code review missed it

WHY 5: Why was there no SAST rule?
→ Secure coding standards did not cover ORM bypass patterns

ROOT CAUSE: Incomplete secure coding standards + missing SAST coverage
```

### Ishikawa (Fishbone) Categories

```
SECURITY INCIDENT CATEGORIES:
├── PEOPLE: Training gaps, staffing, fatigue, insider threat
├── PROCESS: Missing procedures, SLA failures, change management
├── TECHNOLOGY: Misconfiguration, missing patches, tool gaps
├── ENVIRONMENT: Network architecture, cloud misconfig, third-party
├── POLICY: Incomplete standards, unenforced controls, exceptions
└── DETECTION: Missing rules, alert fatigue, log gaps
```

### Fault Tree Analysis

```
TOP EVENT: Data breach via compromised web application
│
├── AND: Attacker gains access + Data is exfiltrable
│   ├── OR: Initial access
│   │   ├── SQL injection (unpatched vuln)
│   │   ├── Credential stuffing (no MFA)
│   │   └── Zero-day exploit
│   └── OR: Data accessible
│       ├── Database in same network zone
│       └── Overly permissive DB credentials
│
└── AND: Exfiltration succeeds + Not detected
    ├── OR: Exfiltration channel (DNS tunnel, HTTPS C2)
    └── OR: Detection failure (no DLP, alert fatigue)
```

## RCA Report Template

```markdown
## Root Cause Analysis — INC-{ID}

**Incident**: {description}  **Severity**: {S1-S4}  **RCA Lead**: {name}

### Root Causes
1. **Primary**: {description}
2. **Contributing**: {description}

### Remediation Actions
| Action | Owner | Due Date | Status |
|--------|-------|----------|--------|
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] RCA completed within 5 business days of closure
- [ ] Root causes identified (not just symptoms)
- [ ] Remediation actions assigned with owners and due dates
- [ ] Systemic recommendations documented
- [ ] RCA findings shared with relevant teams
