Has the system be hardened, patched, and updates applied?ĥ.Have artifacts/malware from the attacker been securely removed?.If any trace of malware or security issues remain in your systems, you may still be losing valuable data, and your liability could increase. Whether you do this yourself, or hire a third party to do it, you need to be thorough. This means all malware should be securely removed, systems should again be hardened and patched, and updates should be applied. EradicationOnce you’ve contained the issue, you need to find and eliminate the root cause of the breach. SEE ALSO: SecurityMetrics Learning Center 4.
Have you applied all recent security patches and updates?.Have all access credentials been reviewed for legitimacy, hardened and changed?.Does your remote access require true multi-factor authentication?.Has any discovered malware been quarantined from the rest of the environment?.What’s been done to contain the breach long term?.What’s been done to contain the breach short term?.This is also a good time to update and patch your systems, review your remote access protocols (requiring mandatory multi-factor authentication), change all user and administrative access credentials and harden all passwords. That way, any compromised data isn’t lost forever. It’s also good to have a redundant system back-up to help restore business operations. Have short-term and long-term containment strategies ready. If you can, disconnect affected devices from the Internet. Instead, contain the breach so it doesn’t spread and cause further damage to your business. However, that will likely hurt you in the long run since you’ll be destroying valuable evidence that you need to determine where the breach started and devise a plan to prevent it from happening again.
ContainmentWhen a breach is first discovered, your initial instinct may be to securely delete everything so you can just get rid of it.
0 kommentar(er)
