Encrypted storage and provision of authentication information for use when responding to an information technology incident

One or more non-transitory computer readable storage media having program instructions stored thereon for improving information technology incident response, the program instructions, when read and executed by a processing system of an incident response system, direct the processing system to:

• receive authentication information and operating parameters associated with a first component of an information technology (IT) environment;
• store an encrypted copy of the authentication information and an encrypted copy of the operating parameters in a data store;
• identify an incident in the IT environment;
• identify a course of action to be used to respond to the incident, wherein the course of action includes a plurality of actions, and wherein the plurality of actions includes an action involving the first component of the IT environment;
• automatically initiate execution of the course of action;
• decrypt the encrypted copy of the authentication information and the encrypted copy of the operating parameters;
• and
• provide the authentication information and at least one of the operating parameters to a second component of the IT environment, wherein the second component uses the authentication information to interact with the first component.

An apparatus of an incident response system for improving information technology incident response, the apparatus comprising:

• one or more non-transitory computer readable storage media;
• a processing system operatively coupled with the one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
• receive authentication information and operating parameters associated with a first component of an information technology (IT) environment;
• store an encrypted copy of the authentication information and an encrypted copy of the operating parameters in a data store;
• identify an incident in the IT environment;
• identify a course of action to be used to respond to the incident, wherein the course of action includes a plurality of actions, and wherein the plurality of actions includes an action involving the first component of the IT environment;
• automatically initiate execution of the course of action;
• decrypt the encrypted copy of the authentication information and the encrypted copy of the operating parameters;
• and
• provide the authentication information and at least one of the operating parameters to a second component of the IT environment, wherein the second component uses the authentication information to interact with the first component.