Part of the problem is often figuring out how and when the bad actor gained access. Sure, you can restore from backups, but if they've been in your system for months you might just be restoring a back door they left.
That's the reason it took my org 2 weeks to recover. Every server that was spun back up had to be isolated from the network and fully inspected before it was put back in use.
We could have been back up and running in much less time, but being thorough is very important.
1 Comments
village604@adultswim.fan · 1 pts · 2d
Part of the problem is often figuring out how and when the bad actor gained access. Sure, you can restore from backups, but if they've been in your system for months you might just be restoring a back door they left.
That's the reason it took my org 2 weeks to recover. Every server that was spun back up had to be isolated from the network and fully inspected before it was put back in use.
We could have been back up and running in much less time, but being thorough is very important.