Certified Information Security Manager (CISM)Incident ManagementMedium
A multinational corporation uses a federated incident response model, where local business units manage their own initial incident response. However, the CISO notes a lack of consistent reporting and insufficient aggregation of threat intelligence across regions, hindering the ability to identify widespread attacks. To improve this, which action should the CISO prioritize?
- ACentralizing all incident response activities under a single global team.
- BProviding advanced forensic training to all local incident response teams.
- CImplementing a standardized incident reporting framework and centralized threat intelligence platform.
- DIncreasing the budget for local security tools and personnel in each business unit.
Show answer & explanationAnswer & explanation
Correct answer: C. Implementing a standardized incident reporting framework and centralized threat intelligence platform.
To address inconsistent reporting and insufficient aggregation of threat intelligence in a federated model, the CISO should prioritize implementing a standardized reporting framework and a centralized threat intelligence platform. This allows local teams to maintain autonomy while ensuring valuable data is consistently collected and analyzed globally.
Why the other options are wrong
- A. Centralizing all activities would negate the federated model and might be impractical for a multinational corporation.
- B. While beneficial, advanced training alone won't solve inconsistent reporting or aggregation issues across disparate teams.
- D. More local resources won't inherently lead to consistent reporting or centralized threat intelligence without a framework for it.
Federated IR Coordination
Ensuring consistent reporting and threat intelligence sharing across decentralized incident response teams in a federated model, balancing local autonomy with global visibility.
- Maintains local response capability.
- Requires standardized processes for global aggregation.
- Leverages centralized platforms for intelligence sharing.
Memory trick: Many local 'eyes' need a 'central brain' to see the whole picture.