A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops No known…

Upon discovering active malware on corporate desktops, the immediate priority is to

prevent its spread and further malicious activity. According to NIST SP 800-61 Rev. 2,

the containment phase follows detection and analysis. Containing the impacted

hosts (Option A) is the most critical first step. This action isolates the infected systems,

preventing the malware from propagating to other systems, communicating with

command-and-control servers, or exfiltrating data. This step is essential to limit the

scope and impact of the incident before eradication and recovery efforts begin.

· B. Add the malware to the application blocklist: This is an important step for

eradication and future prevention but does not address the active malware already

running on the compromised hosts. It's not the first action for immediate security.

· C. Segment the core database server: While network segmentation is a valuable

security control, it's a broader, often proactive, measure. The immediate threat

originates from the infected desktops; addressing these directly through containment is

the priority.

· D. Implement firewall rules to block outbound beaconing: This is a form of network

containment. However, "containing the impacted hosts" is a more comprehensive initial

action. Furthermore, the question states "No known Indicators of compromise have

been found," making it difficult to implement effective specific firewall rules for unknown

beaconing as the first step. Host containment would inherently stop any beaconing

from those hosts.

1. National Institute of Standards and Technology (NIST). (2012). Computer

Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2).

o URL: https://doi.org/10.6028/NIST.SP.800-61r2

o Section 3.4, Page 38 (PDF page 46): "Containment, Eradication, and Recovery.

Containment is important before an incident overwhelms resources or increases

damage. Most incidents require containment, so that is an important consideration

early in the course of handling each incident."

o Section 3.4.1, Page 38 (PDF page 46): Discusses containment strategies,

including disconnecting affected hosts from the network. "The primary goals of

containment are to prevent the threat from spreading to other systems and to prevent

any further damage or impact from occurring."

o Section 3.4.2, Page 41 (PDF page 49): Discusses eradication, which might include

steps like blacklisting applications, but this follows containment.