After a ransomware attack, the team is preparing to restore systems from backups. Investigators believe the attacker was present for several weeks before the encryption began. What should the security manager ensure BEFORE restoration?
Select an answer to reveal the explanation.
Short Explanation
If the attacker was in the house for weeks, last night's photo shows them sitting on your couch. You need a snapshot from before they moved in, and you check it before you trust it. Grabbing the newest backup is the trap.
Full Explanation
Attackers who are present before deploying ransomware often establish persistence, steal credentials and sometimes tamper with backups. Restoring from backups taken during that period can reintroduce the attacker's tools, leading to reinfection. Before restoration, the team should use the investigation's timeline to select backups that predate the compromise, scan and validate them in an isolated environment and confirm the attacker's entry point has been closed. Data created after the selected backup point is then recovered or recreated in a controlled manner. Using the newest backups minimizes data loss but carries a high probability of restoring compromised systems, which defeats the purpose of recovery. Restoring all systems in parallel as quickly as possible may shorten downtime but skips validation and ignores business priorities established in the BIA, increasing the risk of reinfection. A confirmation from the backup vendor that its product was not affected says nothing about whether the data in the backups contains attacker artefacts. Exam caveat: the trade-off between data loss and reinfection risk should be presented to business owners, with recovery point decisions documented. Operational check: confirm the chosen backup dates against the compromise timeline, record validation results and keep restored systems under enhanced monitoring.