Cyber Leaders, managers, engineers, and analysts that have been involved in a cyber event such as a breach, or ransomware: Approximately how long did the forensic analysis team hold your production environment before releasing the environment for mitigation and restoration activities?
Less than 1 week25%
1 to 2 weeks31%
2 to 4 weeks31%
1 month to 3 months6%
3+ months6%
16 PARTICIPANTS
I’ve been involved in multiple events in my career and it really comes down to the situation. Some have been short (hours) and in one case the system was never brought back because it was determined to be inherently insecure and had to be replaced with a different environment.