During post-incident recovery, the IR team is determining when to bring a compromised e-commerce system back online. Which condition must be satisfied before production restoration?
Select an answer to reveal the explanation.
Short Explanation
You don't bring a compromised e-commerce system back online until it's been rebuilt from a known-good baseline, all identified attack vectors are remediated, monitoring is enhanced, and a lessons-learned meeting is scheduled. That gives you a clean system, closed attack paths, better detection, and a path to improve. A press release, a fixed time window, or blocking one attacker address doesn't prove the system is safe.
Full Explanation
The correct condition is that the system has been rebuilt from a known-good baseline, all identified attack vectors have been remediated, monitoring is enhanced, and a lessons-learned meeting has been scheduled. Returning to production requires a clean rebuild rather than patching a potentially backdoored system, remediated vulnerabilities to close attack paths, improved monitoring for earlier detection next time, and documented lessons learned. The CEO-approved press release is wrong because PR activities are a communications function separate from technical recovery readiness. The 72-hour elapsed time condition is wrong because time elapsed is not a security criterion; a system could still be compromised after 72 hours or could be safe to restore in 12 hours. The blocked attacker IP address condition is wrong because blocking a single IP is trivially bypassed and does not indicate the system itself is clean.