Which of the following would be the best action for the incident response team to recommend?

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer’s customers. However, Joe has not resigned or discussed this with his current supervisor yet.

Which of the following would be the best action for the incident response team to recommend?
A . Isolate Joe’s PC from the network
B . Reimage the PC based on standard operating procedures
C . Initiate a remote wipe of Joe’s PC using mobile device management
D . Perform no action until HR or legal counsel advises on next steps

View Answer

Answer: D

Explanation:

The best action for the incident response team to recommend in this scenario is to perform no action until HR or legal counsel advises on next steps. This action can help avoid any potential legal or ethical issues, such as violating employee privacy rights, contractual obligations, or organizational policies. This action can also help ensure that any evidence or information collected from the employee’s system or network is admissible and valid in case of any legal action or dispute. The incident response team should consult with HR or legal counsel before taking any action that may affect the employee’s system or network.