Incident Response and Reporting Flashcards

A financial services firm discovers a sophisticated malware infection on a server processing customer data. According to the NIST SP 800-61 incident response lifecycle, which of the following is a primary objective of the 'Containment, Eradication, and Recovery' phase?

Answer: Isolating the affected server from the network to prevent the malware from spreading.

The 'Containment, Eradication, and Recovery' phase focuses on limiting the scope and impact of the incident. Isolating the affected server is a key containment strategy to stop the threat from spreading to other systems. Analyzing logs is part of 'Detection and Analysis', policy development is 'Preparation', and the post-incident review is 'Post-Incident Activity'.

A European e-commerce company becomes aware of a personal data breach. Under the General Data Protection Regulation (GDPR), what is the maximum timeframe within which the company must notify the relevant supervisory authority, unless the breach is unlikely to result in a risk to individuals' rights and freedoms?

Answer: Within 72 hours of becoming aware of the breach

Article 33 of the GDPR explicitly states that a data controller must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it.

Which of the following activities is MOST characteristic of the 'Post-Incident Activity' phase of the NIST incident response lifecycle?

Answer: Updating the incident response plan based on lessons learned from a recent breach.

The 'Post-Incident Activity' phase is focused on learning from the incident to improve future responses and the organization's overall security posture. A key activity is holding a lessons-learned meeting and using the findings to update policies, procedures, and controls.

A U.S.-based energy company, defined as critical infrastructure, suffers a major cyberattack that disrupts operations. They pay a ransom to the attackers. According to the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), to which federal agency must they report the ransomware payment?

Answer: The Cybersecurity and Infrastructure Security Agency (CISA)

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) mandates that covered entities report covered cyber incidents and ransomware payments directly to the Cybersecurity and Infrastructure Security Agency (CISA).

A business associate of a healthcare provider discovers that a misconfigured server has exposed the protected health information (PHI) of 300 patients. Under the HIPAA Breach Notification Rule, what is the business associate's primary and most immediate reporting obligation?

Answer: Notify the covered entity (the healthcare provider) without unreasonable delay.

The HIPAA Breach Notification Rule requires a business associate to notify the covered entity after discovering a breach 'without unreasonable delay and in no case later than 60 days' following discovery. The covered entity is ultimately responsible for notifying affected individuals and HHS.

An incident response team is handling a data breach. The team leader emphasizes the importance of documenting every action taken, preserving system logs, and creating forensic images of affected hard drives. This meticulous process is most critical for which of the following outcomes?

Answer: Facilitating potential legal action and supporting law enforcement investigations.

While documentation is important for all aspects of incident response, the rigorous preservation of evidence (chain of custody, forensic images, detailed logs) is specifically crucial for supporting any future legal proceedings, regulatory investigations, or law enforcement activities. This ensures the evidence is admissible and can be used to build a case.