Which of the following strategies is recommended for managing communication proactively after an event?

Proactive communication management after a security event requires accurate, timely, and credible information. Conducting a forensic analysis is the systematic process of investigating the incident to determine its scope, impact, and root cause. The factual findings from this analysis are the essential foundation for all subsequent communications. This data allows an organization to inform affected parties, regulators, and law enforcement with precision, thereby controlling the narrative, managing liability, and maintaining trust, rather than reacting to speculation.

A. Regularly backing up data: This is a data recovery and business continuity measure implemented before an incident, not a post-event communication strategy.

C. Implementing multi-factor authentication: This is a preventative access control measure designed to stop an incident from occurring, not a method for managing communication afterward.

D. Keeping antivirus software up to date: This is a preventative security control to protect endpoints; it is not a strategy for managing communication after an incident has already happened.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.2.4, "Containment, Eradication, & Recovery," and Section 3.2.5, "Post-Incident Activity," detail the incident response lifecycle. Forensic analysis is a core component of the analysis and eradication phases. The output of this analysis directly informs the "lessons learned" and reporting activities in the post-incident phase, which are critical for external and internal communication.

2. Cisco. (n.d.). Cisco Product Security Incident Response Team (PSIRT). Cisco Trust Center.

In the "Vulnerability Disclosure" section, Cisco PSIRT's policy states that it discloses details about vulnerabilities, including impact and affected products. This public communication is only possible after a thorough internal investigation and analysis (a form of forensics) to gather the necessary facts. This demonstrates the direct link between technical analysis and post-event communication strategy.

3. Carnegie Mellon University Software Engineering Institute. (1998). An Overview of the Computer Security Incident Response Team (CSIRT) (CMU/SEI-98-TR-001).

Section 3.2, "Reactive Services," lists "Artifact Analysis" as a key service. The report states that the results of such analysis are used to "understand the artifacts and to provide information that can be used to detect and eradicate the problem." This information is then used for announcements and reporting to the organization's constituency.