During which of the following phases should an incident response team document actions required to remove the threat that caused the incident?

The Eradication phase of the incident response lifecycle is specifically focused on removing the threat and its components from the environment. Before executing removal actions, the incident response team must develop and document a clear, actionable plan. This documentation ensures that all necessary steps are identified, sequenced correctly, and approved to completely eliminate the root cause of the incident, such as malware or exploited vulnerabilities, and prevent immediate re-infection. This structured approach is critical for a successful and thorough remediation.

A. Post-incident review: This phase occurs after the incident is fully resolved and focuses on analyzing the response to identify lessons learned.

C. Containment: This phase focuses on isolating affected systems and limiting the spread of the incident, not on permanent removal of the threat.

D. Identification: This phase involves detecting and verifying that an incident has occurred and determining its initial scope.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.3.3

Eradication: This section details the activities for eliminating the components of an incident. It states

"eradication may be necessary to eliminate components of the incident

such as deleting malware and disabling breached user accounts

as well as identifying and mitigating all vulnerabilities that were exploited." The development of a plan for these actions is an implicit and necessary step within this phase.

2. Carnegie Mellon University

Software Engineering Institute. (2016). Defining the Six Phases of Incident Response.

The CERT model outlines six phases

with "Eradication" being the fourth. This phase is defined as the removal of the cause and effects of the incident from the compromised systems. A documented plan is essential to guide this complex process effectively.

3. Tøndel

I. A.

Line

M. B.

& Jaatun

M. G. (2014). Information security incident management: A case study of a Norwegian university. International Journal of Information Security

13(5)

405–418.

Section 2.2

Incident Response Process: This academic paper reviews incident response models

including the NIST framework. It discusses the Eradication phase as the point where the actual cause of the incident is removed

a step that requires careful planning and documentation to be successful. (https://doi.org/10.1007/s10207-013-0223-z)