Certified Incident Handler (CIH) Practice Ecam

What practice helps incident responders contain IoT-based security incidents?

1. Allowing all devices to communicate freely

2. Isolating specific subnetworks of compromised IoT devices using VLANs

3. Enabling public access to IoT device interfaces

4. Implementing open network protocols for all IoT devices

The correct answer is: Isolating specific subnetworks of compromised IoT devices using VLANs

Isolating specific subnetworks of compromised IoT devices using VLANs is a crucial practice for incident responders to contain security incidents effectively. By utilizing VLANs (Virtual Local Area Networks), organizations can create segmented network environments that isolate compromised devices from the rest of the network. This containment strategy prevents lateral movement of threats and reduces the potential damage that could be inflicted if an attacker gains access to a compromised device. When responding to incidents involving IoT devices, it is essential to quickly segregate affected devices to limit their interaction with unaffected systems. This approach minimizes the risk of the incident escalating and protects sensitive data and critical infrastructure from being compromised further. Consequently, this practice forms an integral part of an organization's incident response plan, ensuring that security teams can manage and mitigate incidents involving IoT devices effectively.