You work as an Incident handling manager for a company. The public relations process of the company includes an event that responds to the e-mails…

Based on the standard incident handling lifecycle, such as the one defined in NIST SP 800-61, the phases following Identification are Containment, Eradication, and Recovery. In this scenario: Containment (represented by the non-standard term 'Contamination') is the immediate step to limit the damage, such as by implementing temporary filters or blocking the source of the spam. Eradication involves removing the root cause of the incident, which means fixing the vulnerability in the public relations e-mail process that allows spammers to exploit it. Recovery is the final step in the resolution, where the corrected e-mail process is restored to full, secure operation and monitored to ensure the solution is effective.

A. Identification: This phase is largely complete, as the problem has already been discovered. The question asks for the subsequent phases involved in resolving the issue.
E. Preparation: This phase occurs before an incident is detected. It involves establishing the policies, procedures, and tools for incident handling, not responding to an active incident.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). Section 3.2, "Incident Response Lifecycle," Figure 3-1, and Section 3.3, "Containment, Eradication, and Recovery," pp. 23-29. This document outlines the standard phases, detailing that after Detection and Analysis (Identification), the team moves to Containment, Eradication, and Recovery to resolve the incident.

2. University of Illinois at Urbana-Champaign. (2020). CS 461 / ECE 422: Computer Security I, Lecture 22: Incident Response. Slide 10, "NIST Incident Response Lifecycle." The courseware presents the NIST model, showing that Containment, Eradication, & Recovery are the core phases for handling an identified incident before post-incident activities.

3. Carnegie Mellon University Software Engineering Institute. (2017). Best Practice for Network Incident Response. Section "The Incident Response Process," pp. 4-5. This guide describes the incident response process, which includes the critical steps of containing the incident, eradicating the cause, and recovering normal operations.