What is containment and incident response in cybersecurity for space assets?

What is containment and incident response in cybersecurity for space assets?

• A. A policy document for reporting cyber incidents to leadership.
• B. A method to harden physical access controls.
• C. Procedures to detect, contain, eradicate, and recover from cyber incidents affecting space assets.
• D. A plan for software patch management only.

Answer: (C)

Containment and incident response is about the full, actionable process you use when a cyber event affects space assets. It isn’t just reporting or hardening; it’s the step-by-step plan to handle an incident from identification through restoration. The best answer describes procedures to detect the incident, contain the spread or impact to keep missions safe, eradicate what caused it, and recover normal operations. This lifecycle is essential for space systems because spacecraft, ground stations, and mission operations depend on reliable, timely responses to threats that could compromise navigation, communications, or data integrity. In the space context, containment might mean isolating an affected subsystem, switching to a redundant or safe mode, or revoking compromised credentials to stop the attacker from moving laterally. Eradication involves removing the malicious foothold—like cleaning malware, removing rogue access, or applying targeted mitigations. Recovery focuses on restoring systems to normal, validating spacecraft health and command and data links, and ensuring mission continuity. Finally, lessons learned inform better preparation and future defenses. The other options don’t capture this operational, end-to-end approach. A policy document for reporting incidents is governance-based and doesn’t specify the actions to stop and recover from an incident. A plan for hardening physical access controls targets physical security rather than cyber incident actions. A plan for software patch management alone covers updates, not the broader incident lifecycle of detection, containment, eradication, and recovery.

Containment and incident response is about the full, actionable process you use when a cyber event affects space assets. It isn’t just reporting or hardening; it’s the step-by-step plan to handle an incident from identification through restoration. The best answer describes procedures to detect the incident, contain the spread or impact to keep missions safe, eradicate what caused it, and recover normal operations. This lifecycle is essential for space systems because spacecraft, ground stations, and mission operations depend on reliable, timely responses to threats that could compromise navigation, communications, or data integrity.

In the space context, containment might mean isolating an affected subsystem, switching to a redundant or safe mode, or revoking compromised credentials to stop the attacker from moving laterally. Eradication involves removing the malicious foothold—like cleaning malware, removing rogue access, or applying targeted mitigations. Recovery focuses on restoring systems to normal, validating spacecraft health and command and data links, and ensuring mission continuity. Finally, lessons learned inform better preparation and future defenses.

The other options don’t capture this operational, end-to-end approach. A policy document for reporting incidents is governance-based and doesn’t specify the actions to stop and recover from an incident. A plan for hardening physical access controls targets physical security rather than cyber incident actions. A plan for software patch management alone covers updates, not the broader incident lifecycle of detection, containment, eradication, and recovery.