Control Strategy SuspendInfectedHost.Implementation

URI: CSG-SuspendInfectedHost-Implementation-Runtime

Package: Network

< prev | next >

Description: Device Host has been disabled by its manager HostManager to prevent it being exploited after being infected by malware. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user HostManager who is responsible for managing the device. The Disabled Host control should be deselected only when the host has been restarted.

Blocked Threats (2)

DS.A.HDS.7

Infected host Host encrypts or deletes data Data: an attacker having infected device Host with malware exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.

H.J.GH.7

Malware inserts remote access back door in infected device Host: the malware infecting device Host exploits a vulnerability to insert a means for the attacker to remotely access admin privileges on Host.