Following a high-severity alert indicating a web shell has been uploaded to a public-facing corporate web server, an incident response team is deployed to handle the breach. Place the following incident response actions in the correct sequential order from earliest to latest according to the standard NIST Incident Response Lifecycle.
- 1Analyze web server access logs and system memory to determine the scope of compromise and identify uploaded web shell paths.
- 2Isolate the compromised web server from the internal network segment to prevent lateral movement.
- 3Remove the web shell backdoors, terminate unauthorized processes, and patch the application vulnerability.
- 4Restore the web application from a clean backup image, verify system integrity, and return it to active production.
- 5Conduct a post-incident meeting to document findings, update WAF rules, and improve the incident response playbook.
Answer
The correct sequence follows the standard NIST Incident Response Lifecycle: 1. Analyze web server access logs and system memory, 2. Isolate the compromised web server from the internal network, 3. Remove the web shell backdoors and patch the vulnerability, 4. Restore the web application from a clean backup image and return it to production, 5. Conduct a post-incident meeting to document findings and update WAF rules.
The standard NIST incident response methodology strictly mandates moving through Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. First analyzing system memory and logs allows responders to understand the threat. Network isolation contains the incident from spreading. Eradicating the web shell and patching the vulnerability removes the threat. Restoring from a verified clean backup completes recovery. Finally, conducting a post-mortem review fulfills post-incident obligations.
Step-by-Step Solution
Key Concept
NIST Incident Response Lifecycle (Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity)