Question

The Chief Information Security Officer (CISO) for a large pharmaceutical corporation receives a report that a hacktivist has vandalized one of the company's web servers due to an authentication flaw at the server level.

As an organizational leader working to prevent future incidents, what should be the CISO's top priority?

answer

Identifying the attacker's network details and launching a counterattack to prevent further compromise.


Analyzing the extent of the damage and restoring the server to its original state.


Notifying upper management and pre-emptively releasing a statement to prevent damage to the company's reputation.


Reviewing the company's service-level objectives and incident response plan to ensure they are in keeping with industry best practices.

Answer 1

The CISO's top priority should be **reviewing the company's service-level objectives and incident response plan to ensure they are in keeping with industry best practices.**

While all the options provided are important in the context of responding to a security incident, ensuring that the organization has a robust incident response plan and service-level objectives in place is critical for long-term prevention and resilience. By reviewing and potentially revising these plans, the CISO can ensure that the organization learns from the incident, strengthens its defenses against future attacks, and establishes a framework for effective response and recovery.

This proactive approach focuses on preventing future incidents rather than merely addressing the aftermath of the current one. It's essential to implement the necessary changes to security protocols, authentication systems, and employee training to enhance the overall security posture of the organization.