Containment, Eradication, and Recovery
Stopping the bleeding, then cleaning up
Once an incident is confirmed, containment limits spread. Know the two strategies: short-term containment (isolate host, block IP/domain, disable account, segment network) and long-term containment (rebuild hardened systems, apply temporary fixes, maintain monitoring while eradication proceeds). The choice depends on business impact - isolation may disrupt critical services, so decisions weigh containment against availability.
Eradication and recovery
Eradication removes the root cause: malware, persistence mechanisms, compromised accounts, vulnerable software. Recovery restores normal operations: rebuild from known-good images, validate integrity, monitor closely, and phase return to production. Order matters - do not restore a system before the vulnerability that allowed compromise is fixed, or it will be re-compromised.
Concepts to master
- Containment vs. business continuity: sometimes you monitor-and-contain rather than pull the plug.
- Evidence preservation during containment: capture volatile data (memory, connections) before shutdown or reimage.
- Account and credential remediation: reset passwords, revoke tokens, rotate keys.
- Verification of eradication: confirm no persistence remains before recovery.
- Enhanced monitoring post-recovery to catch re-infection.
Traps in questions
Watch for the urge to immediately power off a machine - this destroys volatile evidence and can trigger ransomware detonation logic. Also, reimaging without root-cause analysis invites reinfection. And containment is not eradication: blocking an IP does not remove the implant.
Rule of thumb
Capture volatile evidence → contain → eradicate root cause → verify → recover → monitor. Never recover onto an unfixed vulnerability.