CAS-005: CompTIA SecurityX

Accounts for John, Ann, and Joe have exposed passwords and should have their credentials reset immediately. Disconnecting their active sessions also invalidates existing authenticated access that could be held by an unauthorized party, providing immediate containment.

CBC requires an unpredictable IV for each encryption operation because the IV is combined with the first plaintext block. A fixed, predictable IV removes this protection and can enable confidentiality attacks that reveal or allow inference of protected plaintext. NIST SP 800-38A specifies that CBC IVs need not be secret but must be unpredictable.

Restoring the isolated system from a known-good baseline snapshot avoids the uncertainty of relying on the attacker's cooperation or on artifacts that may themselves be compromised, making it the most secure recovery path. File versioning may have been created or tampered with during the attack window and cannot be trusted as a clean source, attempting to recover the encryption key is unreliable and does not guarantee removal of any implanted malware, and paying the ransom funds criminal activity while providing no assurance that a working decryption key will be delivered, so security guidance from bodies such as CISA and NIST explicitly discourages it in favor of restoring from verified clean backups or baselines.

A source code escrow places the application's source code with a neutral third party that releases it to the customer if the vendor goes out of business, stops support, or otherwise fails to meet contractual maintenance obligations, which is exactly the scenario described. Code reviews, supply chain visibility, and software audits improve quality and risk awareness at the time they are performed but do nothing to guarantee continued access to or maintainability of the code once the vendor disappears.

File hashes serve as forensic integrity proofs. By computing and recording hashes at the time of seizure, investigators can later verify that files remain unchanged through comparison of hash values. This preserves evidentiary value and maintains chain of custody integrity for court proceedings. Hashes detect tampering (they don't prevent it), and while they create unique identifiers, the primary forensic purpose is validation of file integrity over time.