Prerequisites and process of incident recovery
This phase is designed to return the organization to normal operations and make sure that current cybersecurity incidents, or incidents with the same techniques and procedures, will not happen again.
Recovery covers three major action items:
- Revoke changes:
- Discover what changes were applied by an attacker (for example, email forwarding rules, boot or logon autostart execution points, modified configuration of IT systems, business applications, or security controls)
- Develop the plan to restore the systems to the initial state
- Restore:
- Perform rollback operations based on the developed plan
- Health check:
- Ensure performance metrics are in the green zone
- Confirm the systems work as usual and there are no anomalies in their behavior
The process requires joint efforts, involving all responsible IT, DevOps, DevSecOps, and SRE teams if applicable. The modifications made on the platforms may not require just a configuration...
