Utilizing Signatures for Resolving Virus Attacks
Question
You work as an Incident handling manager for Orangesect Inc.
You detect a virus attack incident in the network of your company.
You develop a signature based on the characteristics of the detected virus.
Which of the following phases in the Incident handling process will utilize the signature to resolve this incident?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.A.
The incident handling process is a set of procedures that aim to detect, analyze, contain, eradicate, and recover from security incidents in an organization's IT infrastructure. In this case, the incident detected is a virus attack, and a signature based on the characteristics of the virus has been developed. The signature is a unique pattern that can be used to identify the virus.
The following are the phases of the incident handling process:
Identification: In this phase, the incident is identified, and the scope and severity of the incident are assessed. The signature developed based on the characteristics of the virus can be used to identify the specific type of virus that has caused the incident.
Containment: In this phase, the incident is contained, and steps are taken to prevent it from spreading further. This includes isolating infected systems, blocking network traffic, and disabling accounts or services that may be affected by the incident. The signature can be used to create rules for intrusion prevention systems (IPS) or firewalls to block traffic associated with the virus.
Eradication: In this phase, the virus is removed from the infected systems. This may involve scanning and cleaning infected files, reinstalling operating systems or applications, or restoring data from backups. The signature can be used to scan for and identify infected files on the systems.
Recovery: In this phase, the systems and data affected by the incident are restored to their previous state. This may involve reinstalling applications, restoring data from backups, or rebuilding systems that were compromised. The signature can be used to ensure that all infected files have been removed before restoring data from backups.
Therefore, based on the above explanation, the correct answer to the question is A. Eradication, as the signature will be used to scan for and identify infected files on the systems to remove the virus from the infected systems.
