During an active security monitoring shift, an analyst discovers anomalous command-and-control (C2) beacons originating from an internal human-machine interface (HMI) jump host connected to a critical industrial control network segment. The incident response playbook mandates immediate action to prevent further lateral movement without shutting down the physical system. Which of the following actions should the analyst perform FIRST according to standard incident response frameworks?
- Isolate the compromised jump host from the network by disabling its active network adapter interfaces.Cevap
- BRe-image the jump host operating system using a clean baseline image from the secure storage repository.
- CPerform a full system power-down of the jump host to preserve memory contents for forensic analysis.
- DReconfigure perimeter firewalls to divert ongoing C2 traffic into an internal honeypot segment for threat intelligence collection.
Cevap
Isolate the compromised jump host from the network by disabling its active network adapter interfaces.
Isolating the compromised host by disabling its network interfaces immediately restricts the attacker's ability to communicate with command-and-control servers or pivot to adjacent industrial control systems. This aligns with the containment phase of standard NIST/ISO incident response playbooks.
Adım Adım Çözüm
Anahtar Kavram
Incident Response Lifecycle - Containment Phase