CISA: Certified Information Systems Auditor

The affected nodes must be identified to establish the incident’s scope and enable accurate containment. Blocking systems before determining which ones are compromised can disrupt legitimate operations while failing to contain all affected assets.