Using Historical Information for Protecting Against Network Attacks
Question
Legal authorities notify a company that its network has been compromised for the second time in two years.
The investigation shows the attackers were able to use the same vulnerability on different systems in both attacks.
Which of the following would have allowed the security team to use historical information to protect against the second attack?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The correct answer is B. Lessons learned.
Lessons learned are a crucial component of any incident response process. They involve conducting an analysis of the event after it has occurred, with the aim of identifying what went wrong and how to prevent similar incidents from happening in the future.
In this scenario, the security team should have conducted a thorough analysis of the first attack to identify the vulnerabilities that were exploited and how they were exploited. They should have then taken steps to remediate those vulnerabilities and implement controls to prevent them from being exploited again.
If the lessons learned from the first attack had been properly documented and implemented, then the security team would have been able to use this historical information to protect against the second attack. They could have checked their remediation efforts to ensure that the vulnerabilities had been properly addressed, and they could have implemented additional controls to prevent similar attacks from occurring.
Key risk indicators (A) are metrics used to monitor an organization's risk exposure. They can be useful in identifying potential vulnerabilities, but they are not directly related to historical information.
Recovery point objectives (C) are a measure of how much data an organization is willing to lose in the event of a disaster. While they are important for disaster recovery planning, they are not directly related to protecting against a second attack.
Tabletop exercises (D) are simulations of a potential incident designed to test an organization's response capabilities. While they can be useful in identifying areas for improvement in an incident response plan, they are not directly related to using historical information to protect against a second attack.
