問題文
A regional bus operator restores its scheduling system from a clean backup within a day of a ransomware attack. The attacker then threatens to publish passenger records that were copied out before the encryption. What does this show about relying on backups alone?
選択肢
- The encryption was not the real attack, so the operator can treat the incident as a plain data breach and close out the availability part of its response entirely.
- Backups answer the availability loss but not the confidentiality loss, so copying data out first gives a second point of pressure.
- Backups are ineffective against this family of malware, because a copy taken before the attack will always contain the same malicious software that encrypted the live system and will therefore reinfect it as soon as the restore finishes.
- The operator should have paid, because paying is the only way to prevent publication and a payment would also have removed the need to spend a day restoring the scheduling system from the backup copies.