An incident response team is recommending changes after analyzing a recent compromise in which:
a large number of events and logs were involved;
team members were not able to identify the anomalous behavior and escalate it in a timely manner; several network systems were affected as a result of the latency in detection;
security engineers were able to mitigate the threat and bring systems back to a stable state; and the issue reoccurred shortly after and systems became unstable again because the correct information was not gathered during the initial identification phase.
Which two recommendations should be made for improving the incident response process? (Choose two.)
Select all that apply, then click Submit answer.
-
○
Formalize reporting requirements and responsibilities to update management and internal stakeholders throughout the incident-handling process effectively.
-
○
Improve the mitigation phase to ensure causes can be quickly identified, and systems returned to a functioning state.
-
○
Implement an automated operation to pull systems events/logs and bring them into an organizational context.
-
○
Allocate additional resources for the containment phase to stabilize systems in a timely manner and reduce an attack’s breadth.
-
○
Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs.
