Containment, Eradication & Recovery
Part of the Cybersecurity Roadmap
In short
These three steps are the heart of fighting back: stop the spread, remove the cause, then rebuild clean. Do them in that order, or you undo your own work.
Containment stops the incident from spreading further, eradication removes the root cause, and recovery restores normal operations — done in that order, since eradicating too early can destroy evidence needed for investigation.
Think of it like this
Dealing with a leaking pipe
First you shut the valve so water stops flooding the house. Then you fix the burst pipe itself. Only then do you mop up and repaint. Shut, fix, restore. Swap the order and you are mopping a floor that is still flooding.
Watch it happen
Stop, remove, rebuild
1/4Isolate affected machines and disable compromised accounts to halt the spread.
The big ideas
What you need to know
Short and long containment
First a quick stop, like pulling a network cable. Then a sturdier fix that lets business continue safely.
Find the root cause
Eradication fails if you remove a symptom but leave the way in open. Close the actual hole.
Trust your backups
Recovery leans on clean, tested backups. Restoring an infected backup just starts the incident again.
Watch after recovery
Attackers often plant a second way back. Heightened monitoring after recovery catches a quiet return.
Save yourself the pain
Common mistakes
Oops
Restoring systems before removing the root cause.
Do this instead
You will just get reinfected. Eradicate the cause first, then recover from a known clean backup.
Oops
Assuming one cleaned machine means it is over.
Do this instead
Attackers spread and hide. Keep monitoring and check for persistence before you call the incident closed.
Your mission
Plan a containment play
Quick check
Why should containment come before eradication?
Go deeper
- 1Design a containment plan for a hypothetical compromised server (isolate, don't immediately wipe).
- 2Learn why rushing to eradication before proper investigation can lose valuable forensic evidence.
- 3Understand recovery includes verifying the threat is truly gone before declaring the incident closed.
More topics at this stop
Incident Response Lifecycle
Incident Triage & Classification
Digital Forensics Fundamentals
Chain of Custody
Memory & Disk Forensics Basics
Malware Analysis Basics
Post-Incident Reporting
Tabletop Exercises
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
