Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A global e-commerce company experiences a data breach involving customer credit card information. The incident response team successfully contained the breach and eradicated the threat. According to best practices for incident response, which of the following is the MOST critical next step for the information security manager?
- ARestore affected systems from the most recent backup.
- BEngage legal counsel to prepare for potential lawsuits.
- CConduct a post-incident review (lessons learned) to identify root causes and improve controls.
- DNotify all affected customers immediately.
Show answer & explanationAnswer & explanation
Correct answer: C. Conduct a post-incident review (lessons learned) to identify root causes and improve controls.
After containment, eradication, and recovery, a critical phase of incident response is the post-incident review (lessons learned). This step systematically analyzes what happened, why it happened, and how to prevent recurrence, leading to improvements in security controls and overall incident response capabilities.
Why the other options are wrong
- A. Restoration is part of the 'Recovery' phase, which typically occurs before the 'Post-Incident Activity' phase.
- B. Engaging legal counsel is important throughout the incident, but the 'lessons learned' review is a specific technical and procedural step to improve security.
- D. Notification is part of recovery and communication but often follows initial system restoration and forensics, and may be guided by legal counsel.
Incident Response Lifecycle
A structured approach to managing the aftermath of a security breach, typically including preparation, identification, containment, eradication, recovery, and post-incident activity.
- Aims to minimize damage and recovery time.
- Involves technical and procedural steps.
- Emphasizes continuous improvement through lessons learned.
Memory trick: Incident response: Prepare, Identify, Contain, Eradicate, Recover, Learn.