Containment, Eradication, and Recovery

Once an incident is confirmed and scoped, the response moves through three consecutive phases: Containment (stop the damage from spreading), Eradication (remove all attacker footholds from the environment), and Recovery (restore systems to normal operation and verify integrity). Each phase has distinct objectives and verification criteria. Moving to recovery before completing eradication is a common error that leads to re-infection from remaining attacker persistence mechanisms.

Containment happens in two stages. Short-term containment provides immediate stabilization — isolating affected systems from the network, blocking attacker IP addresses at the firewall, disabling compromised accounts — to stop active damage. Long-term containment implements more durable controls that allow the organization to continue operating while investigation and eradication proceed — for example, segmenting the compromised network zone rather than taking it offline entirely.

A critical principle: preserve evidence before you remediate. Analysts should capture volatile data (memory dump, running processes, active network connections) and forensic disk images BEFORE taking any action that would alter the system state. Rebooting a system, running malware removal tools, or reimaging without evidence capture destroys the forensic record needed to understand the attack timeline and may also destroy legal evidence needed to prosecute attackers or meet regulatory notification requirements.

Eradication removes all attacker presence from the environment. This is more complex than simply deleting malware files. Persistent attackers establish multiple footholds: scheduled tasks, registry run keys, new user accounts, web shells on servers, modified firmware, and rogue OAuth app consents. A complete eradication checklist must address every technique used by the attacker based on evidence from the investigation phase. Incomplete eradication leads to reinfection — often within hours of returning systems to production.

For endpoints compromised by sophisticated malware or rootkits, reimaging (wiping and reinstalling from a known-clean image) is often preferred over attempting to clean the infected system. Rootkits can hide in locations that antivirus cannot reach, and sophisticated malware may have modified system binaries that are difficult to identify and restore. The decision between cleaning and reimaging depends on: the sophistication of the malware, the sensitivity of the data on the system, and the availability of known-clean images for rapid redeployment.

Eradication must include closing the initial access vulnerability — otherwise the same attacker (or a different one) can re-enter through the same door. Common initial access vulnerabilities include: unpatched software CVEs exploited via internet-facing services, weak or no MFA on remote access systems (VPN, RDP), phishing (requires security awareness training and email filtering improvements), and supply chain compromise (requires vendor security review). Patch and harden before returning systems to production.

Recovery restores affected systems to normal operation from known-good state. Recovery steps include: restoring from clean backups (verifying backup integrity before restoration), rebuilding systems from golden images, reconfiguring network controls (removing temporary containment restrictions), re-enabling disabled accounts (with password resets), and phasing systems back into production incrementally rather than all at once. Incrementally returning systems allows monitoring for signs of re-infection during each phase.

Ransomware specifically targets backup systems to prevent recovery without paying. Effective backup defense requires: offsite backups not connected to the main network, immutable backups (Object Lock, WORM storage) that cannot be encrypted or deleted, air-gapped backups for critical systems, and tested restore procedures. Backup integrity should be verified regularly — a backup that cannot be restored is not a backup. Organizations should know the last clean backup date to determine the recovery point.

After eradication and recovery, enhanced monitoring should continue for an extended period (typically 30-90 days). Some sophisticated attackers plant secondary backdoors that activate after their primary access is detected and removed. Enhanced monitoring includes: increased SIEM alert sensitivity for known attacker IoCs, monitoring for DNS queries to domains similar to attacker infrastructure, watching for communication with any IP addressed seen during the incident, and triggering alerts on any activity from newly created accounts.

Communication management during an incident is as critical as the technical response. Internal communication keeps the organization aligned and prevents rumors. External communication to customers, partners, regulators, and potentially the media must be carefully controlled — premature, inaccurate, or legally problematic disclosures create additional liability. All external communications should be reviewed by legal counsel before release. Regulatory notifications (GDPR 72-hour requirement, HIPAA 60-day requirement) have strict deadlines that run from the date of discovery, not the date of confirmation.

An incident is not closed when the immediate crisis passes — it is closed when all verification criteria are met: all known attacker footholds have been removed and verified, the initial access vulnerability has been patched, all affected systems have been restored and verified clean, enhanced monitoring is in place, required regulatory notifications have been sent, and a post-incident review has been scheduled. Premature incident closure is a common mistake that allows low-level attacker persistence to grow into a second incident.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: containment stops active damage through isolation, firewall blocks, and account disabling, eradication requires removing ALL attacker footholds including persistence mechanisms, not just malware files, and recovery must use backups from before the compromise date and include enhanced monitoring for 30+ days. Next up we explore post-incident review and lessons learned.