An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?
An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?
When an employee clicks on a phishing link that triggers a ransomware attack, the immediate priority is to contain the spread of the ransomware. Isolating the impacted endpoints prevents the ransomware from infecting other systems and minimizes further damage. This step is crucial before any other actions, including notifying senior management or legal counsel. The isolation of affected systems allows time to assess the situation and plan the next steps without the ransomware causing more harm.
The ISM is not going to be isolating anything aka not implementing actions. His role instead would be assess the situation and inform management.
he will not be doing the isolation himself, but instead instructing his direct reports to do it. From there he will reach out to management. But simply not telling their analyst to stop it will allow the problem to go unabated.
B, then D
B. Isolate the impacted endpoints.
In such attacks, quick response makes a difference, hence if device is isolated, mgt can be notified. B then D
D is correct answer - notify senior mgmt. Remember this is a CISManager exam so you would manage the situation both up (to senior mgmt) and down (secops engineers).
B. Isolate the impacted endpoints. Isolating the impacted endpoints should be the information security manager's FIRST step upon discovering that a ransomware attack has been triggered by an employee clicking on a link in a phishing email. This action is essential to prevent the ransomware from spreading further across the organization's network, thereby containing the attack and minimizing potential damage. Isolating affected systems helps in protecting unaffected resources and is a critical step in managing and mitigating the incident effectively. While senior management's involvement and guidance are essential, especially in handling communications, legal considerations, and overarching organizational responses, the urgency of containing the ransomware attack to minimize its impact dictates that notifying senior management should follow after initial containment efforts have been initiated. This approach aligns with incident response best practices that prioritize immediate actions to secure the organization’s IT environment.
D is the best choice, you have to come in terms to define the function of an information security manger, this is managerial position not operation position, if it was CASP+, GIAC, B will be the answer
Report to management first is the correct step even if it does look not a smartest way. In real life, just inform the management first, and another second later, give a call to the IT supervisor to quarantine the PC/whole VLAN/whole network segment. Cut the connections between operations and backup storage links (normally, should always have an airgap)
Manager Himself doesnt do operational work(eg isolate endpoints etc). Also, if the ransomware happened, is too late to deal with endpoints. Now is time to deal with the request hence D, notify the big guys
Containment first. While B and D are essential, do you do B first or D first
Knowing the meaning of the Ransome attack might help. The Ransome attack has already gone beyond containment it already involves payment, and a decision needs to be made
Ransomware is a type of malware that locks and encrypts a victim's data, files, devices or systems, rendering them inaccessible and unusable until the attacker receives a ransom payment 1 pc is locked, i need to FIRST isolate it from the network.
While it's tempting to pick B (isolate), you have to remember that this is management level exam (similar to CISSP). This means you don't touch anything, only consult, advise, steer... While it is absolutely correct that the next thing you do upon confirming the incident is to contain it (in this case, isolate the affected endpoints), as a infosec manager you don't do that, you go ahead and inform management. So D, in my opinion.
ISACA emphasizes the importance of promptly notifying senior management about security incidents to ensure appropriate decision-making, resource allocation, and coordination of response efforts. Senior management needs to be informed early on to understand the potential impact of the incident, assess the organization's risk exposure, and authorize necessary actions.
after confirming an incident, the second step is always containment.
Yes, they do that in the Review Manual, yet in their Sample questions, they first want you to contain, inform the data owners, and then senior management. Refer Qs 96 & 103 (10th Ed). They even go ahead and say that senior management should only be informed if the impact is critical. It sucks what they do to our gullible minds, but well.... the answer is A (??) :).
sorry, I meant, the answer is B. Isolate impacted endpoints.