Incident Containment Methods

Correct Answer: Network segmentation

Network segmentation is the most effective incident containment method for limiting the spread of malware while maintaining critical business operations. This approach allows organizations to isolate infected areas of the network while keeping essential systems operational.

Network segmentation works by dividing the network into smaller, controlled segments. This limits the potential spread of malware to other parts of the network, effectively containing the incident. At the same time, it allows unaffected segments to continue functioning, ensuring that critical business operations can be maintained.

The other options are less suitable:

Full system shutdown would completely halt all business operations, which goes against the requirement of maintaining critical functions.

Disconnecting all external network connections might help prevent further external threats, but it doesn't address the internal spread of malware and could disrupt essential business communications and operations.

Implementing a complete network quarantine, while potentially effective in stopping malware spread, would likely interrupt critical business operations by isolating all network segments, including those that may not be affected.

Network segmentation offers the best balance between containment and operational continuity, making it the most effective choice for a CISM-level incident response strategy.

Correct Answer: Network segmentation

Network segmentation is the most effective incident containment method for preventing lateral movement within a network during an active cyber attack. Here's why:

1. Network segmentation involves dividing a network into smaller, isolated segments or subnetworks.
2. It limits the ability of an attacker to move freely within the network, even if they gain access to one segment.
3. Segmentation creates barriers that contain the spread of malware or unauthorized access.
4. It allows for better access control and monitoring of traffic between segments.

Regarding the other options:

Endpoint detection and response (EDR) is a valuable security tool, but it focuses on individual devices rather than network-wide containment. It may not be as effective in preventing lateral movement across the entire network.

Full system backup and restoration is important for recovery after an attack, but it doesn't actively prevent lateral movement during an ongoing attack.

Implementing a honeypot system can be useful for detecting and studying attacker behavior, but it doesn't directly prevent lateral movement across the network.

Network segmentation stands out as the most effective method for containing lateral movement during an active cyber attack, making it the best choice for a CISM professional focused on overall information security management and strategy.

Correct Answer: Implement device-level isolation and traffic filtering

The most effective incident containment method for neutralizing a compromised IoT device while maintaining overall network functionality is to implement device-level isolation and traffic filtering. This approach allows for targeted containment of the compromised device without disrupting the entire network. Here's why this is the best answer: 1. Targeted approach: It focuses on the specific compromised device, minimizing impact on other network components. 2. Maintains network functionality: By isolating only the affected device, the rest of the network can continue to operate normally. 3. Allows for investigation: While contained, the device can be analyzed to determine the extent of the compromise and potential impact. 4. Flexible and scalable: This method can be applied to individual devices or groups of devices as needed. The other options are less suitable: Conducting a full network shutdown is an overly aggressive approach that would cause unnecessary disruption to business operations and affect all devices, not just the compromised one. Applying aggressive patch management, while important for prevention, is not an immediate containment solution for an already compromised device. It also doesn't address the current threat. Employing network-wide traffic encryption and rerouting protocols is a broad security measure that doesn't specifically address the containment of a single compromised device. It may also introduce unnecessary complexity and potential performance issues across the entire network.