Systems affected by a serious intrusion have been rebuilt and returned to production. What should the security manager ensure happens NEXT?
Select an answer to reveal the explanation.
Short Explanation
Just because the patient's left the hospital doesn't mean you stop checking in. Attackers love coming back to see if their old door still opens. You watch extra closely right after recovery.
Full Explanation
Recovery is not the end of the response. Attackers who have been removed frequently try to return using credentials, infrastructure or techniques they used before, and eradication may have missed something. Heightened monitoring of the restored systems, with detection rules tuned to the indicators and techniques observed during the incident, provides early warning of reinfection or renewed activity and gives confidence that recovery succeeded. The period and intensity of that monitoring should be defined in the plan or agreed by the incident lead. Closing the incident immediately skips post-recovery monitoring and the post-incident review, leaving lessons unlearned and the risk of a quick recurrence. Reducing monitoring to save analyst time inverts the risk logic: the period just after recovery is when renewed attacker activity is most likely. Excluding restored systems from logging removes the evidence and visibility needed to detect a return and to support any further investigation. Exam caveat: the incident should be formally closed only when closure criteria are met, including a period of stable operation and completion of the review. Operational check: confirm monitoring rules include the incident's indicators, the monitoring period is defined and alerts for those systems are prioritized during that period.