Containment, Eradication, and Recovery
Containment
Containment buys time and limits spread. Short-term containment is fast and reversible: network isolation of a host, blocking a domain or IP, disabling a compromised account, segmenting a VLAN. Long-term containment is durable: rebuilt systems, new credentials, architecture changes, added monitoring.
Containment decisions balance damage potential, evidence preservation, service availability, time and resources, and effectiveness. Note the tension: shutting a host down often destroys memory contents, so prefer network isolation when volatile evidence matters.
Eradication
Eradication removes the adversary's presence and the root cause: malware removal, closing the initial access vector (patching, disabling a vulnerable service, revoking tokens, resetting credentials), and removing persistence. Reimaging is often more reliable than cleaning, but only after evidence is captured and scope is understood - eradicating before scoping invites reinfection.
Recovery
Recovery returns to production deliberately: restore from known-good backups, validate integrity, stage the return, rotate credentials, and run enhanced monitoring for re-entry. Business owners accept the risk of return; security does not decide alone.
Traps
Powering off instead of isolating. Treating containment as the end of the incident. Eradicating before scope is known. Restoring from a backup that may itself be compromised, or without verifying restorability. Returning to production with baseline-only monitoring. Deleting attacker tooling before imaging it.
Rule of thumb
Contain first, preserve evidence in parallel, eradicate the root cause rather than the symptom, and only recover with validation plus heightened monitoring.