GSLC: GIAC Security LeadershipDemo

Question

Notifying system owners, requiring password changes for affected user accounts, and increasing monitoring to identify related malicious activity are part of which process?

A Recovery from an incident
B Eradication of an incident
C Preparing for an incident
D Identification of an incident

Explanation

Incident recovery returns affected systems and accounts to normal, secure operation and helps prevent recurrence. It can include changing compromised passwords and increasing logging or network monitoring because previously attacked resources may be targeted again. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Learn more

NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

GSLC: GIAC Security LeadershipDemo

AstroTutor

Notes

Readiness

QuestionQ7

Community Discussion