Question

A computer emergency response team is called at midnight to investigate a case in which a mail server was restarted. After an initial investigation, it was discovered that email is being exfiltrated through an active connection. Which of the following is the NEXT step the team should take?

• Identify the source of the active connection

• Perform eradication of the active connection and recover

• Perform a containment procedure by disconnecting the server

• Format the server and restore its initial configuration

Answer 1

Answer: Identify the source of the active connection

The source of the active connection should be identified first.

It may be possible that the source is a trusted source, in such case the source should be kept connected.

If the connected source is found to be non-trusted the connection should be terminated as soon as possible.

Also, the source should be blocked from any future connection to the mail server.