+DER.2.3.A2 Deciding on a Cleaning Strategy (B)

DER.2.3.A2 Deciding on a Cleaning Strategy (B)

Before an APT incident is actually cleaned up, the management committee MUST define a cleaning strategy. Here, it MUST be decided in particular whether the malware can be removed from the compromised IT systems and whether certain IT systems have to be reinstalled or replaced completely (including their hardware). Furthermore, the IT systems to be cleaned MUST be defined. These decisions MUST be based on the results of a previous forensic examination.

All the IT systems affected SHOULD be reinstalled. Afterwards, the organisation's recovery schemes MUST be followed. Before backups are restored, however, forensic examinations MUST be performed to ensure that no manipulated data or programs will be transferred to a reinstalled IT system.

If the organisation decides that it does not want to reinstall all of its IT systems, a targeted APT clean-up process MUST be implemented. To minimise the risk of overlooked backdoors, IT systems MUST be specifically monitored after the clean-up to see if they are still communicating with the attacker.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
blocks G 0.14 Interception of Information / Espionage
blocks G 0.15 Eavesdropping
blocks G 0.16 Theft of Devices, Storage Media and Documents
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.24 Destruction of Devices or Storage Media
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.41 Sabotage
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information