[Introduction to Incident Handling and Response] Joseph is an incident handling and response (IH&R) team lead in Toro Network Solutions Company. As a part of IH&R process, Joseph alerted the service providers, developers, and manufacturers about the affected resources. Identify the stage of IH&R process Joseph is currently in.

The Containment phase of the Incident Handling and Response (IH&R) process focuses on limiting the operational and financial impact of an incident and preventing it from spreading. Alerting external parties such as service providers, developers, and manufacturers is a critical strategic containment measure. This action helps to coordinate a broader response, such as patching a vulnerable product (developer/manufacturer) or blocking malicious traffic (service provider), thereby containing the threat and limiting further damage to the organization and potentially other entities.

A. Eradication: This phase involves the complete removal of the incident's root cause and all malicious artifacts from the affected systems, not notifying external entities.
C. Incident triage: This is an earlier step within the Detection and Analysis phase, focused on validating, categorizing, and prioritizing the incident, not on active mitigation or external notification.
D. Recovery: This phase occurs after eradication and involves restoring systems to normal operational capability and confirming they are functioning correctly.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2). U.S. Department of Commerce. Retrieved from https://doi.org/10.6028/NIST.SP.800-61r2

Section 3.3.1

"Containment" (Page 25): This section outlines that the primary objective of containment is to prevent an incident from causing further damage. While it focuses on technical actions

the overall strategy may necessitate coordination with external entities to effectively limit the incident's scope

which aligns with the action taken by Joseph.

2. Scarfone

K.

Grance

T.

& Masone

K. (2008). SP 800-92. Guide to Computer Security Log Management. National Institute of Standards and Technology. Retrieved from https://csrc.nist.gov/publications/detail/sp/800-92/final

Section 5.2

"Incident Response" (Page 5-2): This guide

while focused on logging

references the incident response lifecycle from SP 800-61. It reinforces that containment actions are taken "after an incident has been identified and analyzed" to "limit the exposure." Notifying a vendor about a vulnerability being exploited is a key example of limiting exposure.

3. SANS Institute. (2012). The SANS Institute's Incident Handler's Handbook. SANS Institute InfoSec Reading Room. Retrieved from SANS website.

"Containment" Section: The SANS PICERL (Preparation

Identification

Containment

Eradication

Recovery

and Lessons Learned) model is standard in university curricula and professional training. The Containment section explicitly discusses short-term and long-term strategies. Coordinating with vendors and service providers to implement a broader fix or block is a key long-term containment strategy.