Stopping an Intrusion Doesn't Mean the Incident Is Over
When unauthorized access is detected and blocked, the threat might seem contained. But locking the attacker out doesn't answer the most critical questions: What did they do before they were discovered? What did they access? Were they able to exfiltrate data? This is what happened in the recent cyberattack on France's General Directorate of Public Finances. In late June, the agency detected multiple instances of unauthorized access during a routine check and immediately shut them down.