Recovery
After the successful eradication of an incident, the next phase is recovery. The objective of the recovery phase is to ensure that the business is brought back to its original state by restoring the impacted systems.
While implementing recovery procedures, information security management needs to be careful and vigilant to ensure that the same vulnerabilities are not reintroduceOnce a system is compromised, there is no assurance that all abnormalities will be eradicateAn information security manager should avoid rushing to recover. Recovery procedures should be planned, tested, and implemented under the supervision of a senior official. The following are some activities performed during recovery:
- Configuration of the security baseline
- Testing
- Monitoring performance
Practice Question Set 6
- As a newly appointed information security manager, you notice that an organization relies on the manual review of event logs to detect incidents. This leads...
