A hospital investigation can name the imaging server that was encrypted and cannot yet name who performed the encryption. Which attribution element is already known?
Select an answer to reveal the explanation.
Short Explanation
Knowing which room was hit is not the same as naming who did it, filling a chain-of-custody form, or quoting a CVSS score. You can already name the imaging server that was encrypted, and you cannot yet name the actor. The trap is filling in an identity, a form for a drive you have not collected, or a score the case has not established.
Full Explanation
The asset, the imaging server the investigation can already name as the system that was encrypted is the element already known. Attribution separates the affected asset from the actor and from the paperwork around evidence. The investigation can name the imaging server that was encrypted, so the asset is known, and it cannot yet name who did it. The threat actor's identity, the person or group claimed to be behind the encryption is exactly what the case does not have. The person or group behind the encryption is still unknown, so that identity cannot be filled in from the server name alone. The chain-of-custody form for an evidence drive the team has not collected yet documents how evidence is handled after it is collected. The stem does not describe a collected drive or a completed form, and a form would not be the encrypted server. A CVSS score for a weakness that might have allowed the encryption activity to start scores a weakness. No score has been established here, and a vulnerability score is not the name of the system that was encrypted. Exam caveat: naming the asset does not identify a person. One system name, or one address on that system, is not an actor. Operational check: record the imaging server's name and what was encrypted as the known asset, and leave the actor unknown until separate indicators support a name.