A junior cybersecurity analyst has detected a ransomware attack on the company's servers and has activated the incident response team. Which is the…

According to established incident response frameworks, the phase immediately following Detection and Analysis is Containment. The primary goal of containment is to prevent the incident from causing further damage. In a ransomware attack, which can spread rapidly across a network, isolating the compromised servers is the most critical and immediate action. This step limits the scope of the attack and stops the lateral movement of the malware, which is essential before any investigation, eradication, or recovery efforts can effectively begin.

A. Investigating the entry point is a part of the analysis and post-incident phases, performed after the immediate threat is contained.

B. Restoring systems is a recovery action that should only occur after the threat has been fully contained and eradicated from the environment.

D. Updating anti-virus software is a valid step for eradication and future prevention, but immediate isolation is more critical for containing an active, spreading threat.

---

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.3

"Containment

Eradication

and Recovery

" states

"Containment is the first step in this phase... Containment provides time for developing a tailored remediation strategy. An essential part of containment is decision-making... Strategies should be implemented to prevent the incident from spreading." (Page 23). The document explicitly lists isolating network segments as a primary containment strategy.

2. Cybersecurity and Infrastructure Security Agency (CISA) & Multi-State Information Sharing and Analysis Center (MS-ISAC)

Ransomware Guide. In the "Response Checklist

" Step 2 is "Contain the damage and scope of the incident." The guide elaborates: "The first step is to contain the incident so that it can no longer spread... Isolate the infected systems. Immediately disconnect the infected host(s) from the network..." (September 2020

Page 11).

3. Carnegie Mellon University

Software Engineering Institute

Defining Incident Management Processes for CSIRTs: A Work in Progress. This document outlines a generic incident handling process where "Step 3: Contain the Incident" follows detection. It emphasizes that the goal is to "limit the extent of the damage and to prevent any further damage from occurring." (CMU/SEI-2004-TR-015

Page 13).