A mid-sized insurer's SOC analyst observes that a finance workstation is beaconing to a known command-and-control domain every 30 minutes and has begun enumerating SMB shares on the file server. The analyst has confirmed the indicator against threat intelligence and notified the on-call incident manager. What should the incident manager direct as the PRIMARY next action?
- AIsolate the workstation from the network while preserving its running state for forensic triage. Correct
- BRe-image the workstation immediately so the user can resume work before the close of the business day.
- CBlock the command-and-control domain at the perimeter firewall and continue to monitor the workstation in place.
- DNotify the data protection officer and external regulators that a security incident involving personal data is under way.
Why A is correct: Network isolation halts the lateral movement and ongoing exfiltration while keeping memory, processes, and disk artefacts intact for scoping. This is the textbook risk-led containment step before eradication or recovery decisions are made.
Why B is wrong: Re-imaging is part of eradication and recovery, not the immediate next step. Performing it first destroys volatile artefacts the responders need for scoping and may leave related compromised hosts untouched, which is a common pressure-driven mistake.
Why C is wrong: Blocking the domain only addresses one known channel and leaves the compromised host able to pivot internally over SMB. It is a useful supporting control but is not sufficient containment when active enumeration of internal shares has already been observed.
Why D is wrong: Regulator notification follows confirmed scoping, an impact assessment, and a defined notification trigger. Reporting before containment and assessment risks issuing an inaccurate notice and does not stop the ongoing compromise.