Simple explanation
Once an incident is confirmed and scoped, this is the "stop it, remove it, come back online" phase — the active response work most people picture when they think of incident response.
Technical explanation
- Containment — stopping the incident from spreading further, without necessarily fixing the root cause yet. Techniques range from network isolation (disconnecting an affected system) to account disabling to firewall rule changes — chosen based on balancing speed against evidence preservation.
- Short-term vs. long-term containment — a quick, temporary measure (isolate the host) buys time for a more durable fix (rebuild from a known-clean image) without leaving the environment exposed in the meantime.
- Eradication — removing the actual cause: deleting malware, closing the vulnerability that allowed initial access, revoking compromised credentials, removing any persistence mechanisms the attacker planted.
- Recovery — restoring affected systems to normal operation, typically from clean backups rather than attempting to "clean" a compromised system in place (since full confidence that every trace was removed is hard to achieve any other way). Recovery includes validating the fix actually worked before declaring the incident closed.
- Order of operations matters: containing before eradicating prevents re-infection during cleanup; eradicating before recovery prevents restoring a system only to have it immediately re-compromised by a cause that was never actually removed.
Synonyms / related terms
| Term | Means | |---|---| | Isolation | A common containment technique — disconnecting a system from the network | | Rebuild from image | A common eradication/recovery technique for compromised endpoints | | Root cause | What eradication specifically targets |
Concept Check
"A team restores a compromised server from backup immediately after detecting ransomware, without first identifying how the ransomware got in." This skips eradication — restoring from backup is a recovery action, but without removing the actual entry point (an unpatched vulnerability, a phishing-compromised account still active), the restored system is highly likely to be reinfected through the exact same path.
Interview-style Q&A
Q: Why is rebuilding from a known-clean image generally preferred over trying to manually clean a compromised system? A: "Confidence. It's extremely difficult to prove a system is 100% clean after compromise — sophisticated malware can leave persistence mechanisms that are easy to miss during manual cleanup. Rebuilding from a trusted image eliminates that uncertainty entirely, at the cost of some downtime, which is almost always the better trade."
Memory trick
"Contain, then Cure, then Come back" — the three Cs, strictly in order: stop the spread, remove the cause, then and only then restore normal operation.