A manufacturing company discovers unusual network activity at 3 AM on a Saturday when no employees should be accessing the system. Their intrusion detection system has flagged multiple failed login attempts from an overseas IP address. What should be the company's immediate priority according to security incident response best practices?

Question

BlackTom AI · Accepted Answer

Incident response best practices prioritize containment and documentation as the immediate actions when suspicious activity is detected.

1) Relevant knowledge points and concepts
- Incident response lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. 
- Containment limits attacker activity and prevents further damage; documentation preserves forensic evidence and supports legal/insurance processes. 
- Avoiding destructive or ad-hoc actions (e.g., immediate full shutdown) preserves volatile data (RAM, active connections, logs).

2) Step-by-step reasoning process
- Identification: IDS flagged multiple failed logins from an overseas IP at 3 AM — this indicates probable brute-force/reconnaissance and must be treated as a potential incident. 
- Immediate priority is containment to stop further unauthorized access and evidence preservation for investigation. 
- Activate incident response team and follow the predefined incident response plan.

3) Intermediate steps (operational actions)
- Short-term containment: block or rate-limit the overseas IP at perimeter devices, isolate affected accounts/systems, enforce password resets or temporary account locks, enable MFA where available.
- Evidence preservation: secure logs, capture packet data, note timestamps, record steps taken (chain of custody).
- Increase monitoring and alert thresholds while planning eradication and recovery.

4) Why the correct answer is correct
- Following the established incident response plan ensures coordinated containment and thorough documentation, minimizing damage while preserving forensic integrity. It aligns with best practices and legal/compliance needs.

5) Why other options are incorrect
- Waiting until Monday allows the attacker time to escalate access or exfiltrate data. 
- Shutting down all systems can destroy volatile evidence and unnecessarily disrupt operations; it’s only justified in extreme cases. 
- Sending a company-wide email risks panic, leaks, and tipping off the attacker. 
- Buying new software is a long-term measure and does not address the immediate incident.

6) Conclusion
- The correct immediate priority is to follow the established incident response plan to contain and document the threat, which matches the provided answer.

类似问题

What is the primary purpose of the Act stage in the OODA loop?

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

When developing an Incident Response Plan, you need procedures that ensure _________.

An Incident Response Plan does NOT _________.

Establishing logging, monitoring, and response procedures for security incidents occurs during:

Name the Supreme Court decision that removed financial constraints on PACs.

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单