Question

Following a major outage caused by a ransomware infection that spread from a single phishing-compromised workstation, the incident response team has completed containment and full recovery. During the lessons-learned meeting, the security manager wants to ensure the review produces durable improvements rather than assigning individual blame. Which approach BEST supports identifying systemic corrective actions at the root-cause level?

Accepted Answer

Use an iterative causal analysis technique (e.g., 'five whys') to trace the incident past the proximate cause and identify contributing process and control gaps that enabled propagation

Answer

Document the timeline of analyst actions and rate each responder's performance against the runbook to identify who deviated from procedure

Answer

Prioritize immediately re-imaging all affected hosts and rotating credentials so operations can resume before the review is finalized

Answer

Submit the incident metrics (MTTD, MTTR, dwell time) to the board and close the incident once the numbers meet the SLA targets