A security analyst is executing an incident response playbook following the detection of an unauthorized rogue wireless access point connected to an enterprise network switch. According to the NIST Incident Response Framework (NIST SP 800-61 Rev. 2), in what chronological order should the analyst perform the response actions below?
- 1Validate the alert by reviewing wireless intrusion prevention system (WIPS) logs to confirm the unauthorized access point.
- 2Disable the specific switch port connected to the rogue device to stop unauthorized network traffic traversal.
- 3Physically remove the rogue access point from the site and configure 802.1X port security restrictions on the switch.
- 4Hold a post-incident review meeting with stakeholders to update wireless security policies and playbook procedures.
Answer
The correct sequence follows the NIST Incident Response lifecycle: 1) Validate the alert via WIPS logs (Detection & Analysis), 2) Disable the switch port (Containment), 3) Physically remove the rogue access point and configure 802.1X (Eradication & Recovery), and 4) Hold a post-incident review meeting (Post-Incident Activity).
The standard incident response framework dictates four major sequential phases: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. The response begins by validating the alert through WIPS log analysis to confirm the threat. Next, the switch port is disabled to contain network traffic and limit potential compromise. Following containment, the physical rogue device is eradicated and port security controls are applied for recovery. Finally, post-incident activities occur to document lessons learned and update operational playbooks.
Step-by-Step Solution
Key Concept
NIST Incident Response Lifecycle (NIST SP 800-61 Rev. 2)
Estimated Time:1m 30s