hard20 pts · first answer countsincident-responsesupply-chain

Malware in a signed vendor update

A vendor reports its software update server was hacked and a signed update contained a backdoor. Your EDR saw nothing because the file was signed. What is the right response?

A.Trust the hosts, because a valid signature proves the code is safeB.Treat every host that installed the update as possibly compromised and hunt for the IOCsC.Only uninstall the software from servers, as laptops cannot be affectedD.Wait for the vendor to release the next update and do nothing until then

Discussion 0

Join free to post in the discussion.

Malware in a signed vendor update

Discussion 0

Related questions