An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware downloads. An information analyst observes an alert at the SIEM and engages the cybersecurity team to conduct an analysis of this incident in accordance with the incident response plan. Which event detail should be included in this root cause analysis?

Root Cause Analysis (RCA) aims to identify the fundamental origin of an incident to prevent recurrence. In this scenario, the phishing email is the initial attack vector that initiated the entire event chain. The employee clicking the link, the malware download, and the subsequent SIEM alert are all consequences stemming from this initial cause. Therefore, the phishing email itself is the root cause that must be analyzed. Understanding how the malicious email bypassed filters and deceived the user is critical for implementing effective corrective actions, such as enhanced email security controls and user awareness training.

B. The SIEM alarm is a detection event that occurred after the compromise; it is a symptom of the incident, not its cause.
C. Information from the email header is a piece of evidence used during the analysis of the root cause, but it is not the root cause event itself.
D. The cybersecurity team identifying the alert is a step in the incident response process, a reaction to the incident, not the cause of it. ---

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide.

Section 3.3.3

Eradication and Recovery

states: "During this phase

it is also important to identify the root cause of the incident and all vulnerabilities that were exploited so that they can be addressed." This highlights the need to find the initial vulnerability or vector

which in this case is the phishing email.

2. Cisco. (2018). Cisco 2018 Annual Cybersecurity Report.

Page 11

"Email: Still a Favorite Attack Vector

" discusses how adversaries continue to use social engineering tactics like phishing because they are effective. The report implicitly identifies the malicious email as the starting point (root cause) of such security incidents that must be analyzed.

3. Carnegie Mellon University Software Engineering Institute. (2016). Defining Incident Management Processes for CSIRTs: A Work in Progress.

Section 4.2

"Analysis

" describes the process of analyzing data to determine the "who

what

when

where

why

and how" of an incident. Identifying the initial point of compromise

such as a phishing email

is a primary goal of this phase to understand the root cause.