A global financial Institution experienced a sophisticated cyber-attack where attackers gained access to the internal...

Isolating Affected Systems:

Containment: Immediately isolate compromised systems to prevent further data exfiltration and limit the spread of the attack.

Minimize Impact: This step helps to mitigate ongoing damage and protect unaffected systems.

Analyzing Network Traffic:

Identify Anomalies: Analyze network traffic to identify any anomalies or patterns indicative of the attack. This helps to understand the attack vector and extent of the breach.

Gather Evidence: Collect evidence that can be used to trace the attacker's methods and identify vulnerabilities.

Additional Steps:

After containment and analysis, the incident response team can proceed with notifying law enforcement, conducting a system audit, and managing public relations.

References:

Incident response best practices:NIST Computer Security Incident Handling Guide

Strategies for cyber incident containment: SANS Institute

Top of Form

Bottom of Form