During a physical security audit at a remote branch office, a security analyst discovers an unauthorized rogue wireless access point connected directly to a network switch port. The rogue device is broadcasting an unencrypted SSID and bridging external wireless traffic directly into the internal corporate network segment. According to standard incident response frameworks, which of the following actions should the analyst perform FIRST?
- Disable the specific physical switch port connected to the rogue device to isolate it from the internal network.Cevap
- BReflash the network switch firmware to eliminate potential persistent malware installed by the rogue device.
- CSchedule a lessons-learned meeting with branch site managers to revise physical access control policies.
- DConfigure a dynamic perimeter firewall rule to block all inbound 802.11 wireless frame traffic.
Cevap
Disabling the specific physical switch port connected to the rogue device is the immediate first action to contain the security incident.
Upon discovering an active rogue access point connected to an internal switch, the immediate priority in the incident response process is Containment. Disabling the physical switch port isolates the rogue access point and halts unauthorized bridging into the corporate network.
Adım Adım Çözüm
Anahtar Kavram
Incident Response Process - Containment Phase