In which of the following incident handling and response stages, the root cause of the incident must be found from the forensic results?

In the standard incident response lifecycle, the Eradication phase focuses on eliminating the root cause of the incident to prevent recurrence. This can only be accomplished after a thorough analysis of forensic evidence has identified the root cause (e.g., the specific vulnerability exploited, the compromised credentials, or the malware family). Therefore, finding the root cause is a critical prerequisite for the Eradication phase to begin. The goal of eradication is to remove the attacker's artifacts and eliminate the initial vector of compromise.

A. Evidence Gathering: This is the process of collecting data. The root cause is determined by analyzing this evidence, not simply by gathering it.
B. Evidence Handling: This refers to the procedures (e.g., chain of custody) for preserving the integrity of evidence throughout the investigation, not the analysis itself.
D. Systems Recovery: This phase occurs after eradication and involves restoring systems to normal operation. The root cause must have already been found and eliminated.

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61, Revision 2). Section 3.3.4, "Eradication and Recovery," p. 3-16. The guide states, "For example, for a malware infection, the root cause may be an unpatched vulnerability. Eradication would involve patching the vulnerability." This implies the root cause must be known for eradication to be effective.

MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 21, "Incident Response." The lecture outlines the incident response phases, where analysis to find the root cause precedes the eradication step.