During security monitoring, a Security Operations Center (SOC) analyst verifies that a database server hosting critical business records has executed an unauthorized executable from a temporary directory and opened an active outbound connection to a suspicious external endpoint. The threat analyst confirms the host is compromised. According to standard incident response process frameworks, which of the following actions should the analyst perform FIRST?
- Isolate the compromised database server from the network while maintaining host power to preserve volatile memory evidence.Answer
- BPerform a complete system re-image of the database server using clean baseline backup media.
- CDeploy updated web application firewall rules to prevent incoming SQL injection traffic.
- DAnalyze the malicious binary to determine if its propagation characteristics classify it as a self-replicating worm.
Answer
Isolate the compromised database server from the network while maintaining host power to preserve volatile memory evidence.
In standard incident response frameworks (such as NIST SP 800-61), once an incident is verified, the immediate priority is containment. Isolating the server from the network prevents the adversary from exfiltrating data or moving laterally to other enterprise resources. Keeping the machine powered on ensures volatile memory (RAM) is preserved for forensic analysis.
Step-by-Step Solution
Key Concept
Incident Response Lifecycle - Containment Phase Execution