A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?

Question

Options

• Atell him to shut down the server
• Btell him to call the police
• Ctell him to invoke the incident response process
• Dtell him to analyze the problem, preserve the evidence and provide a full analysis and report

• A
  9% (4)
• B
  7% (3)
• C
  82% (37)
• D
  2% (1)

Explanation

C is correct because any suspected security incident - including a potential XSS attack - must be handled through the organization's formal incident response (IR) process, which ensures a coordinated, documented, and legally defensible response rather than ad hoc decisions made under pressure.

Why the others are wrong:

• A (shut down the server) is premature and causes unnecessary downtime; the attack may not even be confirmed yet, and taking systems offline without authorization or assessment can cause more business harm than the incident itself.
• B (call the police) may eventually be appropriate, but it is not the first step - the IR process determines when and whether law enforcement involvement is warranted.
• D (analyze, preserve, report) describes individual tasks within incident response, but having one person act unilaterally skips the process - IR requires a team, defined roles, chain of custody, and management notification.

Memory tip: Think of IR as the "911 call" for security - just like you don't start treating a patient before calling emergency services, you don't start forensics before invoking the incident response plan. "Incident = IR process, always."

No community discussion yet for this question.