An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

According to standard incident response frameworks, such as the one detailed in NIST SP 800-61, the lifecycle phase following Detection & Analysis is Containment. The question states the network "has been affected by malware," implying the incident has already been detected and identified. Therefore, the immediate priority is to prevent the malware from spreading and causing further damage. Isolating affected devices is a primary containment strategy that limits the incident's scope, providing the response team with time to conduct a deeper analysis and plan for eradication. This action directly addresses the immediate threat and minimizes business impact.

A. Make an incident response plan. This is incorrect because creating a plan is a core activity of the Preparation phase, which must be completed before an incident occurs.
B. Prepare incident response tools. This is incorrect as tool preparation and deployment kits should be established during the Preparation phase, well in advance of an active incident.
D. Capture network traffic for analysis. This is incorrect as a first step. While traffic analysis is crucial, allowing active malware to remain connected to the network while setting up captures poses a significant risk of further spread and damage. Containment must be the immediate priority.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide": Section 3.3, "Containment, Eradication, and Recovery" (Page 23) states, "After an incident has been detected and analyzed, the incident response team should determine how to contain it... Containment is important before an incident overwhelms resources or increases damage." This explicitly places containment as the first action after detection.

2. Carnegie Mellon University, CERT Division, "Best Practices for Preventing and Responding to Insider Attacks": In the outlined response steps, it states, "Step 3: Contain the situation. Once an incident is confirmed, your first priority is to contain it and prevent additional damage." This reinforces the principle of containment as the immediate priority.

3. ISO/IEC 27035-2:2016, "Information technology — Security techniques — Information security incident management — Part 2: Guidelines to plan and prepare for incident response": This international standard outlines a process where, following detection and assessment, the immediate response involves containment actions to limit the extent of the damage.