Which of the following presents the GREATEST challenge to the recovery of critical systems and data following a ransomware incident?

The primary and most effective strategy for recovering from a ransomware incident is to restore data and systems from a known-good backup. If backups are unavailable (e.g., also encrypted by the attacker, physically destroyed, or inaccessible) or are found to be corrupt upon attempted restoration, the organization's ability to recover is fundamentally compromised. This situation leaves the organization with very few options, such as attempting to pay the ransom (with no guarantee of success) or rebuilding from scratch, which may be impossible for critical data. Therefore, the state of the backups is the single most critical factor determining the success of a recovery effort.

A. Lack of encryption for backup data in transit is a confidentiality risk during the backup process, not the greatest challenge to recovery after an incident has already occurred.

B. Undefined backup retention policies can lead to restoring outdated data, but it is a lesser problem than having no functional backups at all.

C. Ineffective alert configurations are a root cause that can lead to failed backups, but the direct and greatest challenge during recovery is the resulting unavailability of the backups themselves.

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management. The manual emphasizes that effective incident response and recovery are predicated on the successful execution of the business continuity and disaster recovery plans. A core component of these plans is the ability to restore systems from backups. The unavailability of these backups represents a catastrophic failure of the recovery strategy itself. (Specifically

see Chapter 4

Section 2.6: Recovery Strategy Development).

2. NIST Special Publication 1800-26

Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events. Section 3.3

"Recover

" states: "The ability to recover individual files

or entire systems

is dependent on the existence of backup files that are stored in a secure

offline location." This highlights that the very existence and usability of backups are the foundation of recovery.

3. NIST Special Publication 800-34

Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 3.5.2

"Recovery Strategies

" discusses the importance of having reliable recovery capabilities. The guide implicitly supports that if the chosen recovery option (e.g.

restoring from backups) is unavailable

the entire recovery strategy fails

making it the greatest possible challenge.

4. Kharraz

A.

Robertson

W.

Balzarotti

D.

Bilge

L.

& Kirda

E. (2015). Cutting the Gordian Knot: A Look at Ransomware Attacks. In Proceedings of the 12th International Conference on Detection of Intrusions and Malware

and Vulnerability Assessment (DIMVA). The paper's analysis of ransomware underscores that the primary defense and recovery mechanism is a robust backup strategy. The failure of this mechanism (e.g.

corrupt or unavailable backups) is presented as the critical point of failure for victims. (DOI not available for this specific conference proceeding

but widely cited in the domain).