Investigators discover that a skilled attacker has had quiet, persistent access to multiple systems for months. There is no sign of ongoing data theft or damage. What is the BEST approach to containment?
Select an answer to reveal the explanation.
Short Explanation
If you pull one weed and leave the roots, the attacker just pops up somewhere else and now they know you're onto them. You quietly map every foothold, then you clear them all in one coordinated move. The trap is acting fast on the first host you find.
Full Explanation
With a sophisticated, persistent attacker, piecemeal containment is a known failure pattern. Removing one foothold signals that the intrusion has been discovered, prompting the attacker to change tools, deepen persistence or cause damage, while access through the footholds not yet found continues. When there is no evidence of ongoing harm, the better approach is a planned, coordinated response: monitor discreetly to map compromised systems, accounts and persistence mechanisms, prepare containment and eradication actions, then execute them simultaneously so the attacker is removed from all footholds at once. Disconnecting the first identified host is appropriate when active harm is occurring, but here it would mainly tip off the attacker. Publicly announcing the breach immediately has the same effect and is premature, since disclosure decisions require facts about scope and data and guidance from counsel. Wiping and rebuilding systems one at a time is piecemeal eradication with the same signalling problem, and it destroys evidence before scope is understood. Exam caveat: the decision to delay containment is a risk decision that senior management should endorse, with triggers defined for acting immediately if harm appears. Operational check: confirm a documented response plan, monitoring coverage of known footholds and agreed escalation triggers.