A user has been unable to authenticate to the company's external, web-based database after clicking a link in an email that required the user to change the account password. Which of the following steps should the company take next?

The scenario describes a classic phishing attack. The user was lured by a malicious email to a fraudulent website where their credentials were likely harvested. The inability to log in afterward confirms a probable account compromise. The immediate and most critical step is to contain the threat by disabling the user's account, which prevents the attacker from using the stolen credentials to access the database. Concurrently, informing the security team is essential to initiate the formal incident response process, which includes investigation, damage assessment, and eradication of the threat. This two-pronged approach prioritizes security and follows standard incident handling procedures. Why Incorrect Options are Wrong
B. Create a new log-in to the external database. This action fails to address the compromised account, leaving it accessible to the attacker and posing an ongoing security risk.
C. Ask the user to use the link again to reset the password. This is extremely dangerous as it would direct the user back to the malicious phishing site, potentially compounding the security breach.
D. Reset the user's password and ask the user to log in again. While a password reset is necessary, it is not the first step. The security team must be notified to investigate the breach before restoring access. --- References
1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Page 27, Section 3.3.2, Containment: "Containment strategies vary based on the type of incident. For example, the strategy for containing an email-borne malware infection is very different from that of a network-based DDoS attack. In certain cases, it is more effective to temporarily disable an account,..." This supports disabling the account as a primary containment step. Page 11, Section 2.3.3, Incident Reporting: "Users should be told who to contact to report a suspected incident... Incidents should be reported quickly so that they can be analyzed and contained." This supports the requirement to inform the security team.
2. University of California, Berkeley, Information Security Office, Phishing FAQ. Section: "What to do if you have responded to a phishing scam": The guidance explicitly states, "Report the incident. Reporting the incident is the most important step you can take to protect yourself and the campus." It further instructs to contact the IT help desk or security team, who would then take actions such as disabling accounts to mitigate the threat. This aligns with the chosen answer's emphasis on reporting and containment.
3. Carnegie Mellon University, Software Engineering Institute (SEI), Defining Incident Response. Document: "CSIRT Services": In describing incident response, the process is outlined as Prepare -> Detect -> Analyze -> Contain -> Eradicate -> Recover. The scenario represents the "Detect" and "Analyze" phase, and the correct next step is "Contain." Disabling the account is a direct containment action. The document states, "Containment is the set of actions taken to prevent an incident from spreading or causing further damage."