Incidents · Question 12 of 12
After an attack the manipulated files have been replaced and the vulnerability closed. What else must you think of?
3 answers are correct. Hard
Show answer
Answer
- A Monitoring the system particularly closely in the following months
- B Changing all passwords and credentials
- D Backdoors such as newly created backend users or hidden PHP files
Explanation
Attackers often leave backdoors, such as inconspicuous admin accounts or obfuscated code deep in the file system. That is why you change all access credentials, check users and files and monitor the system closely afterwards. Log files are needed for the analysis.