Incident Response & Reporting Flashcards
9 cards from real CDFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 9 Incident Response & Reporting flashcards as text
What is the first step in incident response?
Answer: Identifying the incident
The first step in incident response is identifying the incident, which involves detecting and confirming that a security event has occurred. This initial phase is crucial for understanding the nature, scope, and severity of the breach or attack. Accurate identification allows the response team to activate appropriate protocols and allocate resources effectively to mitigate the threat.
Why is containment important in incident response?
Answer: To limit damage
Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. This involves isolating affected systems, networks, or data to prevent further spread of malware, unauthorized access, or data exfiltration. Effective containment minimizes the damage, reduces the overall cost, and accelerates the effort required for recovery.
What is the purpose of eradication in incident response?
Answer: To remove cause of incident
The purpose of eradication in incident response is to completely remove the root cause of the security incident from all affected systems. This involves eliminating malware, patching vulnerabilities, disabling compromised accounts, and addressing any configuration weaknesses. Eradication ensures that the threat is entirely neutralized, preventing its recurrence before systems are restored to operation.
Why is recovery a critical phase?
Answer: It restores normal operations
Recovery is a critical phase in incident response because its primary goal is to restore affected systems and services to normal, secure operation. This involves rebuilding systems, restoring data from backups, and verifying functionality after the threat has been eradicated. A successful recovery minimizes business disruption, ensures continuity, and reinforces the organization's resilience.
What should be included in incident reports?
Answer: Comprehensive incident details
Incident reports should include comprehensive details about the security incident to provide a clear and accurate record. This encompasses information such as the timeline of events, affected systems, type of attack, actions taken, and individuals involved. Detailed reporting is essential for post-incident analysis, legal documentation, and improving future response strategies and security measures.
Who should be notified during a major security incident?
Answer: All relevant stakeholders
During a major security incident, it is crucial to notify all relevant stakeholders, which includes not only IT staff but also management, legal counsel, public relations, and potentially affected customers or regulatory bodies. Timely and transparent communication ensures everyone is informed, can take necessary actions, and helps manage the incident's impact, reputation, and legal obligations effectively.
Why is post-incident analysis important?
Answer: To improve response and prevent recurrence
Post-incident analysis is crucial for learning from security incidents and continuously improving an organization's security posture. By thoroughly reviewing what happened, why it happened, and how it was handled, teams can identify weaknesses in defenses, refine response procedures, and implement preventative measures. This process helps prevent similar incidents from occurring in the future, enhancing overall resilience.
What is a key characteristic of an effective incident response team?
Answer: Trained and coordinated team
A key characteristic of an effective incident response team is that it is well-trained and highly coordinated. Team members must possess the necessary technical skills, clearly understand their roles and responsibilities, and be able to communicate and collaborate seamlessly under pressure. This preparedness ensures a swift, efficient, and effective response to security incidents, minimizing their impact.
Which documentation aids in compliance and audits?
Answer: Detailed incident documentation
Detailed incident documentation is crucial for compliance and audits in digital forensics because it provides a clear, chronological record of events, actions taken, and evidence collected. This comprehensive record demonstrates adherence to legal and regulatory requirements, aids in post-incident analysis, and stands up to scrutiny during internal or external audits.