Option D sounds a bit risky to me. 'Start in the monitored policy'? That means you're just watching and waiting for attacks to happen. I'd rather be proactive with B and block that ransomware before it even tries to get in.
Haha, C is funny. 'Analytics will automatically block the attacks' - yeah, right, if only it were that simple! I think B is the way to go, get that ransomware-like behavior rule enabled ASAP.
I'm not sure I agree with B. Doesn't that just look for behavior that resembles ransomware? Wouldn't it be better to actually identify vulnerable software and patch it (A) to prevent the attacks in the first place?
Option B seems like the most direct way to address the ransomware concern. Turning on the ransomware-like behavior rule will actively block the attacks, which is what the organization needs.
Felix
5 months agoDorathy
5 months agoVivan
5 months agoDorathy
5 months agoWinfred
5 months agoRebbecca
5 months agoVince
5 months agoCarolann
4 months agoEvangelina
4 months agoCeleste
5 months agoMerissa
5 months agoAlesia
5 months ago