Question 91 · 1243 in bank
An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?
Show answer
Answer: B
Explanation
B. Isolate the impacted endpoints. Isolating the impacted endpoints should be the information security manager's FIRST step upon discovering that a ransomware attack has been triggered by an employee clicking on a link in a phishing email. This action is essential to prevent the ransomware from spreading further across the organization's network, thereby containing the attack and minimizing potential damage. Isolating affected systems helps in protecting unaffected resources and is a critical step in managing and mitigating the incident effectively. While senior management's involvement and guidance are essential, especially in handling communications, legal considerations, and overarching organizational responses, the urgency of containing the ransomware attack to minimize its impact dictates that notifying senior management should follow after initial containment efforts have been initiated. This approach aligns with incident response best practices that prioritize immediate actions to secure the organization’s IT environment.
Source: Adapted from community discussion — helg420