During a city council livestream, attendees report a suspected wireless man-in-the-middle near the chambers. What incident-response approach is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Suspected MitM calls for the wireless IR playbook—validate, contain, preserve, talk to stakeholders—not panic wipes or tweet-a-deauth. Coordinate WIPS and SOC like grown-ups.
Full Explanation
Wireless incident response for suspected MitM should follow a defined runbook: detection validation with WIPS and SOC, containment, evidence preservation, and stakeholder communication. Uncontrolled wipes, crowdsourced attacks, or wholesale infrastructure shutdowns without process create further harm.