How should the BCC respond to a cyberattack targeting data links?

• A. Shut down all systems and wait for orders.
• B. Isolate affected nodes, switch to alternate communications, preserve critical data, and rekey as needed.
• C. Ignore and continue normal ops.
• D. Re-route through non-secure channels.

Answer: (B)

When a cyberattack targets data links, the priority is containment, continuity, and credential hygiene. Isolating the affected nodes stops the attacker from moving laterally and helps limit damage. Switching to alternate communications keeps critical operations going even if the primary link is compromised. Preserving critical data ensures you have the necessary information to recover and conduct any forensic analysis later. Rekeying as needed resets compromised keys and credentials, reducing the chance the attacker can re-enter or intercept communications.

These steps together address stopping the spread while maintaining essential capability. Shutting down all systems and waiting for orders introduces avoidable downtime, while continuing normal operations or ignoring the incident leaves assets exposed. Re-routing through non-secure channels increases risk and defeats the purpose of securing communications.