Incident Containment, Eradication, and Recovery

This chapter covers the critical incident handling steps that must be taken once an incident has been detected, confirmed, and analyzed. By this stage, the intrusion should be fully examined, the scope of the infection should be addressed, and the threat actor’s tactics, techniques, procedures, and used infrastructure should be identified.

We will start by discussing the criticality of isolating the affected systems to prevent further damage and stop the attacker’s progress toward the final goal. The importance of obvious and hidden aspects such as timing, scoping of containment, and the limitations will be explained. Incident containment is the first part that minimizes the impact on the organization. We will explain the impact components based on the latest industry research conducted by Trellix: https://www.trellix.com/assets/ebooks/restricted/trellix-mind-of-the-ciso-report-ebook-behind-the-breach.pdf.

Then, various...