An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?
An intrusion has been detected and contained. Which of the following steps represents the BEST practice for ensuring the integrity of the recovered system?
Restoring the operating system, patches, and application from the original source is the best practice to ensure the integrity of the recovered system after an intrusion. It guarantees that the system is rebuilt from the ground up using trusted sources, eliminating any potential remnants of the intrusion or vulnerabilities that may exist in backups or forensic copies.
After compromise, always reimage
C for me
need to OS install. should not use backup because it may be intruded.
The BEST practice for ensuring the integrity of the recovered system after an intrusion has been detected and contained is to install the operating system (OS), patches, and applications from the original source (Option B).
fresh install from the original source is the best way.
I will go with Option A
Forensics copies are made after the intrusion as evidence of the attack for later investigation. If I restore it, then we have the same problem.
Agreed. What you say makes total sense.
B. Install the OS, patches, and application from the original source.
A. Restore the application and data from a forensic copy. Restoring the system from a forensic copy ensures that you are using a known, clean, and unaltered version of the application and data. This is important because the original source (option B) and regular backups (option C) might also contain the same vulnerabilities or malware that allowed the intrusion in the first place. Option D, while important, is not sufficient on its own, as it may not guarantee the removal of all traces of the intrusion. Restoring from a forensic copy is a standard practice in digital forensics to ensure the integrity of the system and preserve evidence for further investigation if needed.
Changing my answer to OPTION A
OPTION B
Not a good question. The problems are 1. What has gone bad, Data or OS. 2. Restoring from backup, when was the backup. Was that a good backup? If the intrusion is indeed unknown the first date, reinstall the OS, reinstall the application, get the good known data from backup. I will stay with backup since the place I work does the hourly backup and disk dup.
awful question. ensuring the integrity of investigating or business operations?? Investigating is A, operations is B