Containment, Eradication & Recovery

Summary

Containment stops the incident from spreading further, eradication removes the root cause, and recovery restores normal operations — done in that order, since eradicating too early can destroy evidence needed for investigation.

• 1Design a containment plan for a hypothetical compromised server (isolate, don't immediately wipe).
• 2Learn why rushing to eradication before proper investigation can lose valuable forensic evidence.
• 3Understand recovery includes verifying the threat is truly gone before declaring the incident closed.