[Introduction to Incident Handling and Response] Which of the following is not a countermeasure to eradicate cloud security incidents?

The eradication phase of the incident response lifecycle focuses on removing the root cause of the incident and eliminating malicious artifacts from the affected systems. Countermeasures include patching vulnerabilities, removing malware, and hardening systems to prevent recurrence. Disabling fundamental security controls like two-factor authentication (2FA) and CAPTCHA is counterintuitive to security best practices. Such an action would actively weaken the system's security posture, increase the attack surface, and potentially facilitate re-entry for an attacker, directly contradicting the goals of eradication.

A. Patching vulnerabilities and improving isolation are fundamental eradication activities aimed at eliminating the exploited weakness and containing the threat.
B. Removing malware files and associated traces is a primary objective of the eradication phase, ensuring the threat is completely eliminated from the environment.
C. Checking and improving data protection controls is a valid hardening step within the eradication and recovery phases to prevent future data breaches.

1. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide": Section 3.4.3

"Eradication

" states that this phase involves actions such as "remediating vulnerabilities to prevent similar incidents." Disabling security controls is the opposite of this principle. The guide emphasizes eliminating the components of the incident

such as deleting malware and disabling breached user accounts.

2. Cloud Security Alliance (CSA)

"Security Guidance for Critical Areas of Focus in Cloud Computing v4.0": Domain 5

"Security Operations

" discusses incident management. It outlines that eradication involves removing the cause of the incident

which includes patching systems and removing malware

not weakening existing security controls (p. 103).

3. Carnegie Mellon University

Software Engineering Institute

"Defining the Cloud-Native Incident Response Process" (2022): This document discusses the incident response lifecycle in cloud environments. The Eradication step is described as removing the threat from the environment. Actions include "patching vulnerabilities" and "removing malicious code

" while recovery involves "hardening systems." Disabling security features like 2FA would be a direct violation of these principles (Section 4.4

p. 14).