You work as an Incident handling manager for Orangesect Inc. You detect a virus attack incident in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the Incident handling process will utilize the signature to resolve this incident?

The Eradication phase of the incident handling process focuses on the complete removal of the incident's components from the affected systems. After a virus is identified and the incident is contained, a signature is developed to be used by security tools, such as antivirus or endpoint detection and response (EDR) systems. These tools then scan all hosts to find and eliminate every instance of the malicious code, thereby eradicating the threat from the environment. This action directly aligns with the primary goal of the Eradication phase, which is to remove the root cause of the incident.

B. Identification: This phase involves detecting the incident and determining its scope. The signature was created after the virus was already detected, so this phase has passed.
C. Recovery: This phase involves restoring systems to normal, trusted operation after the threat has been completely removed. It is the step that follows eradication.
D. Containment: This phase focuses on limiting the spread and impact of the incident, for example, by isolating affected systems, not on removing the malware itself.

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.3.2, "Eradication and Recovery," states, "After an incident has been contained, eradication may be necessary to eliminate components of the incident, such as deleting malware and disabling breached user accounts..." (Page 42). This directly supports using a signature to delete malware as an eradication activity.

2. Carnegie Mellon University, Software Engineering Institute, Defining Incident Management Processes for CSIRTs: A Work in Progress. This document, which outlines foundational concepts for incident response, describes the "Eradicate" step as "Remove the cause and the effects of the incident." (Section 4.2, Step 5). Developing and deploying a signature to remove a virus is a primary example of this step.