A large enterprise has been targeted by a ransomware attack…
A large enterprise has been targeted by a ransomware attack that encrypts critical business data, paralyzing operations. The IRT has identified the attack and confirmed that several files have been locked. While the attack is contained to specific servers, the organization must decide whether to pay the ransom or restore from backups.Question:What actions should the incident response team (IRT) take in the initial response phase to mitigate the damage from the ransomware attack, and what factors should guide the decision-making process regarding whether to pay the ransom or restore from backups? Note: the ideal answer should describe two things 1) Actions 2) Guiding factors