ISP Security Investigations & Incident Response Flashcards

Which phase of an incident response plan involves returning systems to normal operations after a security event?

Answer: Recovery

The recovery phase restores affected systems and verifies they are clean and functional before returning them to production.

What is the primary legal reason for maintaining a 'chain of custody' during a security investigation?

Answer: To preserve the integrity and admissibility of evidence in legal or disciplinary proceedings

Proper chain of custody documents who handled evidence and when, ensuring it has not been tampered with and remains legally admissible.

A security investigator discovers a suspicious USB drive in a secured area. The FIRST action should be:

Answer: Photograph it in place, document its location, and secure it as evidence without inserting it into any system

Documenting and preserving the device without connecting it protects both evidence integrity and facility systems from potential malware.

An industrial security investigation MUST remain within which legal boundary when interviewing employees?

Answer: Employees must be informed of their rights, and interviews must comply with applicable labor and employment law

Industrial security investigations must respect labor laws, privacy rights, and employee rights to counsel to avoid legal liability.

Which type of investigation focuses specifically on determining the root cause of a security system failure rather than identifying a perpetrator?

Answer: Root cause analysis (RCA) / technical investigation

RCA investigations analyze system failures, process gaps, or equipment malfunctions to prevent recurrence rather than to assign criminal liability.

When must a security incident be reported to the relevant government authority in a cleared industrial facility?

Answer: Whenever a reportable security incident occurs, per the facility's reporting requirements and DD Form 577 obligations

Government-cleared facilities are obligated to report security incidents to their Cognizant Security Agency (CSA) as specified in their facility clearance agreement.