Containment, Eradication and Recovery

Question 1

Containment

Answer 1

reduce or eliminate the spread of the incident; includes preserving evidence

Question 2

Eradication

Answer 2

return all systems to a known good state; rebuild systems

Question 3

Recovery

Answer 3

identify the relevant attack vectors and implement countermeasures

Question 4

What criteria you need to consider in Containment

Answer 4

Scope
Segmentation (micro)
Isolation
Removal

Question 5

To Remove or Not Remove

Answer 5

Threat Intelligence value
Crime Scene Evidence
Ability to restore

Question 6

What criteria you need to consider in Eradication?

Answer 6

All systems returned to a known good state

Be sure to gather Evidence first

Rebuild instead of repair

Question 7

What criteria you need to consider in Recovery?

Answer 7

Vulnerability mitigations

Sanitization

Reconstruction

Secure Disposal

Patching - vendor specific patch requirement

Permissions

Question 8

Factors for Considerations

Answer 8

Impact

Isolation

remediation

Compensating controls