CompTIA CySA+ (CS0-003)Incident Response and ManagementMedium
After an organization successfully recovers from a significant data breach, the incident response team conducts a thorough review. They identify that the breach originated from an unpatched vulnerability in a legacy system and that communication between teams was inefficient. Which of the following activities is the MOST important outcome of this review process?
- AUpdating the incident response plan and implementing lessons learned.
- BPurchasing a new, more expensive security information and event management (SIEM) system.
- CPublicly disclosing the names of the attackers and their affiliation.
- DImplementing immediate termination of personnel responsible for the unpatched system.
Show answer & explanationAnswer & explanation
Correct answer: A. Updating the incident response plan and implementing lessons learned.
The post-incident review, or 'lessons learned' phase, is designed to identify what went wrong and how to improve. Updating the incident response plan and implementing those lessons is the most crucial outcome to strengthen future defenses and response capabilities.
Why the other options are wrong
- B. Purchasing a new SIEM might be a solution, but it's an action, not the overarching 'outcome' of the review, which is process improvement based on findings.
- C. Attacker attribution and public disclosure might be part of external communication but is not the primary internal outcome for process improvement.
- D. Personnel termination can be a consequence but is not the primary 'outcome' for improving the IR process itself.
Post-Incident Review (Lessons Learned)
A critical phase in incident response where the team analyzes the incident, evaluates the response, identifies areas for improvement, and updates policies and procedures.
- Occurs after recovery and incident closure.
- Focuses on continuous improvement.
- Results in updated IR plans, training, and security controls.
- Identifies root causes and response deficiencies.
Memory trick: After the storm, 'Reflect, Refine, Rebuild' for resilience.