by stop50 on 9/13/2023, 2:39:14 PM
1. Companies have usually more than one server 2. The servers have to be checked for backdoors. This means that every file has to be scanned against modifications and unexpected code. 3. People need to go through thousands of lines of logs to check if data has been exfiltrated and if the server was used for lateral movement.
When companies or organisations are victims of a cyber-attack, they often claim that it will take a significant amount to time (i.e., months) to investigate and assess the impact of the incident, what parts of their systems were accessed, the type and amount of data stolen by the attackers, etc.
As someone with no expertise in cybersecurity I have no idea if that argument makes sense or not. I suppose that larger companies with more complex IT structures will need more time to complete an assessment compared to smaller ones. But, a technical investigation spanning months?
Part of the relevance of this question is because, often, the potential victims of a cyber-attack are not just the company or organisation that was breached but their employees, suppliers, customers, etc. The limited or lack of information while the investigation is being conducted might leave them "out in the cold" for quite a long time.
So, I wanted to ask you. Thanks.