CompTIA CySA+ (CS0-003)Incident Response and ManagementMedium
A cyber incident response team is conducting a post-incident review after successfully containing and eradicating a sophisticated malware outbreak. The team has gathered data from various sources, including security logs, network traffic captures, and analyst notes. The primary goal of this phase is to refine future response capabilities. Which of the following activities is the MOST crucial for achieving this primary goal during the post-incident review?
- AUpdating the organization's public relations statement regarding the incident.
- BIdentifying lessons learned and updating incident response plans and playbooks.
- CNotifying all affected external stakeholders about the breach details.
- DCalculating the total financial cost incurred due to the incident.
Show answer & explanationAnswer & explanation
Correct answer: B. Identifying lessons learned and updating incident response plans and playbooks.
The post-incident review's primary goal is to improve future response capabilities. Identifying lessons learned, analyzing what worked and what didn't, and subsequently updating plans and playbooks directly addresses this goal by making the organization more resilient and effective in handling future incidents.
Why the other options are wrong
- A. Public relations are part of external communications, not directly related to improving internal response capabilities.
- C. Stakeholder notification is a compliance and communication activity, not focused on internal process improvement.
- D. Financial cost calculation is important for business impact but not the primary driver for improving response procedures.
Post-Incident Review (Lessons Learned)
A critical phase in incident response where the team analyzes the incident, evaluates the effectiveness of the response, and identifies areas for improvement.
- Focuses on 'lessons learned'.
- Aims to improve future incident response capabilities.
- Results in updates to plans, policies, and procedures.
Memory trick: Review, Refine, Relearn