CompTIA CySA+ (CS0-003)Incident Response and ManagementHard
During the recovery phase of an incident, a security team is tasked with restoring services after a major ransomware attack. The team has successfully eradicated the ransomware and verified the integrity of backups. Which of the following is the MOST critical next step before bringing affected systems back online?
- AImplement enhanced network segmentation for critical assets.
- BUpdate all affected user passwords to strong, unique credentials.
- CVerify that the root cause of the initial compromise has been fully remediated.
- DPerform a comprehensive vulnerability scan of all restored systems.
Show answer & explanationAnswer & explanation
Correct answer: C. Verify that the root cause of the initial compromise has been fully remediated.
Before bringing systems back online, it is absolutely critical to ensure that the original vulnerability or entry point that led to the ransomware attack has been identified and completely remediated. Failing to do so would leave the organization susceptible to an immediate re-infection or further compromise, making all recovery efforts futile.
Why the other options are wrong
- A. Enhanced network segmentation is a valuable security improvement, but it addresses symptom mitigation rather than the core problem of the initial compromise.
- B. Updating passwords is a good security practice and often necessary, but if the root cause (e.g., an unpatched server, a compromised RDP port) isn't fixed, new passwords won't prevent a repeat attack.
- D. Vulnerability scanning is important for ongoing security, but it's secondary to fixing the specific root cause that allowed the initial breach.
Root Cause Remediation (Recovery Phase)
The process of identifying and fixing the fundamental reason for an incident, ensuring that the vulnerability exploited is fully closed before systems are returned to operation.
- Crucial for preventing recurrence.
- Often involves patching, configuration changes, or process improvements.
- Must be confirmed before full system restoration.
Memory trick: Don't just fix the wound, cure the disease before you send the patient home.