Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A global e-commerce company experiences a data breach involving customer credit card information. The incident response team has contained the breach and is now in the recovery phase. Which of the following is the MOST critical activity during the recovery phase to prevent recurrence and restore normal operations?
- ANotifying affected customers and regulatory bodies about the breach.
- BConducting a comprehensive post-incident review to identify root causes and lessons learned.
- CRestoring affected systems from known good backups and verifying data integrity.
- DImplementing enhanced security monitoring and intrusion detection systems.
Show answer & explanationAnswer & explanation
Correct answer: B. Conducting a comprehensive post-incident review to identify root causes and lessons learned.
While restoring systems and implementing new controls are crucial, the 'MOST critical' activity to prevent recurrence and improve future response is the post-incident review. This review identifies the root causes, evaluates the effectiveness of the response, and generates lessons learned, which are essential for long-term improvement and preventing similar incidents.
Why the other options are wrong
- A. Notification is part of the post-incident phase, but it's a communication requirement, not directly focused on preventing recurrence or improving security posture.
- C. Restoring systems is a key part of recovery, but without understanding why the breach happened, recurrence is likely.
- D. Enhanced monitoring is a control improvement, but its effectiveness depends on understanding the specific weaknesses revealed by the incident, which comes from the review.
Post-Incident Review (Lessons Learned)
A formal process conducted after a security incident to analyze what happened, evaluate the effectiveness of the response, identify root causes, and determine improvements.
- Critical for continuous improvement.
- Identifies root causes.
- Informs policy and control updates.
Memory trick: After the fire, inspect the ashes to prevent the next one.