A security analyst is implementing an incident response playbook following a confirmed unauthorized access event on an internal code repository server. Arrange the following incident response actions in the correct chronological sequence according to standard NIST SP 800-61 guidelines, from first to last.
- 1Analyze SIEM event logs and system artifacts to identify the scope and attack vector of the incident.
- 2Revoke compromised repository access credentials and isolate the affected server from the internal network.
- 3Re-image the repository server from a clean, verified baseline image and restore authorized codebase backups.
- 4Document the incident timeline, publish root-cause findings, and update developer access control policies.
Cevap
The correct chronological sequence is: (1) Analyze SIEM event logs and system artifacts, (2) Revoke compromised credentials and isolate the affected server, (3) Re-image the repository server from a clean baseline, and (4) Document the incident timeline and update policies.
According to the NIST SP 800-61 incident response framework, the lifecycle follows a strict sequence: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity (Lessons Learned). Analyzing logs identifies the breach scope first, followed by isolating the server and revoking compromised credentials to contain the threat. Once contained, the server is re-imaged and restored during eradication and recovery. Finally, root-cause documentation and policy updates are conducted during post-incident lessons learned.
Adım Adım Çözüm
Anahtar Kavram
NIST Incident Response Lifecycle Sequential Phases