Containing an active intrusion would require taking the e-commerce platform offline during peak trading. The incident response plan does not pre-authorize the security team to shut down revenue systems. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
This is a business trade-off: risk of a bigger breach versus lost sales. You're the advisor who lays out the options clearly, but the person who owns the platform makes the call. Acting alone, in either direction, is the trap.
Full Explanation
Containment decisions that significantly affect business operations involve a trade-off between security risk and business impact, and accountability for that trade-off rests with the business owner or senior management with the relevant authority. The security manager's role is to provide a clear, timely assessment: what the attacker can do if the platform stays online, what containment options exist, the impact of each on revenue and customers, and a recommendation. The authorized decision maker then chooses, and the decision is recorded. Taking the platform offline unilaterally exceeds the authority the plan grants and assumes that security outweighs business impact in every case, which is not a risk-based position. Leaving it online without informing management means the security team is effectively accepting the risk itself and withholding information decision makers need. Letting the IT operations manager decide based on availability targets places the decision with someone who does not own the business risk and considers only one dimension of it. Exam caveat: plans should pre-define decision authority and thresholds so that such decisions are made quickly; where a plan grants emergency containment authority, the manager follows it. Operational check: confirm the decision, the decision maker, the options considered and the time are recorded in the incident log.