What are the first three steps in the Incident Response process?

• A. Detection, Assessment, Review
• B. Detection, Recovery, Correction
• C. Detection, Containment/Eradication, Recovery/Closure
• D. Identification, Resolution, Follow-up

Answer: (C)

The first three steps in the Incident Response process are Detection, Containment/Eradication, and Recovery/Closure.

Detection is the initial phase where potential security incidents are identified through monitoring systems, alerts, and reporting from users. Early detection is crucial for minimizing damage and ensuring a prompt response to threats.

The next step, Containment/Eradication, involves taking immediate actions to limit the impact of the incident. This requires containing the threat to prevent further spread while simultaneously working on the eradication of the root cause of the incident. This phase is critical to ensuring that normal operations can be restored and that the vulnerabilities exploited in the incident are addressed.

Finally, the Recovery/Closure phase focuses on restoring and validating system functionality for business operations. It ensures that affected systems are brought back to normal, and any changes made during the incident response are documented and reviewed to improve future incident response efforts.

This sequence is essential for a structured and effective response to incidents, emphasizing the importance of both preparedness and recovery in maintaining IT security.