Incident response · Question 12 of 12
After a phishing incident, the affected account is locked and the e-mail deleted from all mailboxes. Two weeks later, the attacker is back. What was probably neglected?
2 answers are correct. Hard
Show answer
Answer
- A Analysis of the scope
- B Thorough eradication of all access paths
Explanation
After a break-in, attackers often create additional access, such as mail forwarding rules, OAuth grants or new accounts. If these are overlooked during eradication, they come back. A thorough analysis of the scope comes before recovery.