Containment, Eradication, and Recovery
Here the exam checks judgment under pressure: choosing containment that stops the spread without destroying evidence or the business, and knowing the criteria that let you move on.
Containment
- Options range from soft (monitoring, blocking a domain, forcing password resets) to hard (network isolation, disabling accounts, shutting a network segment).
- Choose based on attacker awareness, propagation speed, business impact, and evidence needs. If the adversary knows you have detected them, delaying containment buys them time.
- Short-term containment stops the bleeding; long-term containment (rebuilding segments, re-architecting access) restores durable control.
- Prefer surgical isolation - EDR network containment keeps the host powered and memory intact - over pulling the plug. Powering off a ransomware host can lose in-memory key material and destabilise encryption state.
Eradication and recovery
- Eradication removes the root cause, not just the visible symptom: malware, persistence, rogue accounts, vulnerable services, and stolen credentials. Credential resets belong here.
- Recovery means returning to a known-good, monitored state: rebuild rather than clean when integrity is doubtful, restore from backups verified to predate the compromise, validate with scanning and configuration checks, then watch closely under heightened monitoring for a defined period.
- Define exit criteria in advance - no anomalous authentication for X days, EDR clean, patches applied - and obtain business sign-off before restoring production.
Worked example
A file server is encrypting shares. Containment: isolate the server via EDR, disable the compromised service account, block the C2 domain at egress. You do not power it off, because key material may still be recoverable from memory for forensic use. Eradication: identify the initial access vector (a VPN account without MFA) and close it, reset every credential that touched the host, remove the scheduled-task persistence. Recovery: restore data from an offline backup verified to be older than the dwell time, then monitor for 30 days.
Traps
- Reimaging the only evidence source before imaging it.
- Restoring from a backup that already contains the implant.
- Declaring recovery complete while attacker persistence or credentials remain live.
- Containing so aggressively that the business cannot operate when a narrower action would have sufficed - and failing to document the trade-off.