Question

During a malware incident, the incident response team has isolated the affected servers and removed the identified malicious files. Management is pressuring the information security manager to restore the servers to production immediately to minimize downtime. What should the information security manager do BEFORE authorizing recovery to production?

Accepted Answer

Verify that the root cause has been eradicated and that no persistence mechanisms remain

Answer

Restore the systems from the most recent backup and monitor for reinfection

Answer

Complete the post-incident review and document lessons learned

Answer

Notify all affected business units that services are being restored