Certified Incident Handler (CIH) Practice Ecam

Which of the following is a common first step in incident response after a web application security incident?

1. Isolate the affected systems

2. Notify law enforcement

3. Report to external stakeholders

4. Delete any affected code

The correct answer is: Isolate the affected systems

Isolating the affected systems is a critical first step in incident response following a web application security incident. This action serves to contain the threat, preventing further damage to the system and protecting any remaining uninfected components. By isolating the systems, incident responders can analyze the incident without the risk of the attacker or malware spreading to other environments or systems, which could lead to more extensive data loss or compromise. In the context of cybersecurity, containment is paramount. It allows teams to enact a thorough investigation into how the breach occurred while mitigating risk. Once the systems have been isolated, further steps such as notifying law enforcement or reporting to external stakeholders can be addressed, but the immediate priority is to prevent additional exposure or losses by controlling the situation at hand.