The eradication stage of Incident response plan

Question 1

1st Step

Answer 1

Sanitization removes all traces of the threat by overwriting the drive multiple times to ensure the threat is removed. This is the correct action for hard disk drives when you must ensure that all traces of the compromise are gone or when the validation stage indicates remaining issues.

Question 2

2nd Step

Answer 2

Reconstruction/re-imaging means reinstalling the operating system, applying all system updates, reinstalling the anti-malware software, and implementing any organization security settings. It may also mean reimaging the device. This is the correct action to take when all traces of the compromise must be gone and you need to reuse the device.

Question 3

Secure Disposal

Answer 3

Secure disposal is to dispose of the compromised device (or its storage drive) rather than attempting to sanitize and re-use the device. This is the correct action to take when there are no plans to reuse the device.

Question 4

Rollback Plan

Answer 4

A rollback plan, which is used to reverse the effects of an faulty update does not take place during the recovery stage of IR. This plan, if necessary, would have been executed much earlier in the IR process.