A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user’s laptop while traveling. The attacker has the user’s credentials and is attempting to connect to the network. What is the next step in handling the incident?

According to the NIST incident response lifecycle (SP 800-61), after an incident is detected and analyzed (validated), the next critical step is to understand its scope. The attacker has valid user credentials, meaning the threat is not limited to the initial laptop or source IP. The immediate priority is to determine the "blast radius" by identifying which other systems, services, and data the compromised credentials have access to. This scoping activity is essential for planning an effective containment strategy and preventing further compromise or lateral movement.

A: Blocking a single source IP is an insufficient containment measure because the attacker has valid credentials and can connect from anywhere. B: An antivirus scan is part of a deeper analysis or eradication, but the immediate priority is understanding the scope of potential access. D: Identifying lateral movement is part of scoping, but you must first identify what systems are at risk (C) before you can effectively look for movement to them.

1. Cisco, "Incident Response: A Proactive Approach to Handling Security Breaches," White Paper (2016). This paper emphasizes the importance of scoping an incident, stating, "The team must determine the extent of the incident... Which systems were affected? What information was compromised?" (p. 4).

2. National Institute of Standards and Technology (NIST), "Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide" (August 2012). Section 3.2.3, "Containment," notes that a major prerequisite is "obtaining management approval," which requires a clear understanding of the incident's scope and potential impact on business operations.

3. Stanford University, "Information Security Incident Response Procedure". The procedure outlines that after initial analysis, the next step is to "Assess the scope and potential impact of the incident," which aligns with identifying systems at risk.