Reference no: EM133469054

Incident Scenario:

For the purposes of this scenario, imagine that your customer has 100 PCs connected to the network. Your network/PC support team consists of four people: A network manager, the network/server administrator and two desktop support people. You all typically work on-site alongside your colleagues.

The office just opened at 7:00AM for employees that like to start work early. Most people start work around 8:00AM, but there are a bunch of people that start closer to 9:00AM, so you have coverage until 6:00PM. The early employees are turning on their computers and discovering a problem. After the computers have booted up they begin to act unusually. Popups and adware are massively infecting dozens of PCs making them basically unusable. If one PC is cleaned with the installed AV application, it becomes infected again a few minutes later. Every PC is installed with a paid subscription to Norton Antivirus, and you know that it is current and updated because it was just checked two days ago. Nevertheless, there is a problem. Fortunately, one of the desktop support people and the network administrator arrived at 7:15AM and they are expecting their other two colleagues to arrive by 8:00AM.

Recovery-Bring systems back into production

1. How will your team get systems functioning again? Provide specific steps and guidance that you will refer to during the incident.
2. Post-Mortem Review-Complete explanation of the incident and the resolution.
3. Also, identify the configuration management, security countermeasures and implementation recommendations that should be implemented to prevent this from happening in the future.
4. What steps will your team follow to explain the cause of the incident, the resolution and what you will do to prevent similar incidents in the future?