1 1 00:00:00,300 --> 00:00:01,890 Recovery. 2 2 00:00:01,890 --> 00:00:03,930 So at this point, we've covered eradication. 3 3 00:00:03,930 --> 00:00:06,420 Now we're going to talk about recovery. 4 4 00:00:06,420 --> 00:00:07,860 First for a quick review, 5 5 00:00:07,860 --> 00:00:10,170 we talked about eradication and recovery 6 6 00:00:10,170 --> 00:00:12,210 as the removal of the cause of the incident 7 7 00:00:12,210 --> 00:00:15,150 and bringing the system back to a secure state. 8 8 00:00:15,150 --> 00:00:17,160 Now, when we talk about recovery specifically, 9 9 00:00:17,160 --> 00:00:18,780 we're talking about the actions taken 10 10 00:00:18,780 --> 00:00:21,030 to ensure the hosts are fully reconfigured 11 11 00:00:21,030 --> 00:00:22,920 to operate the business workflow 12 12 00:00:22,920 --> 00:00:24,630 the way they were performing those things 13 13 00:00:24,630 --> 00:00:26,370 before the incident occurred. 14 14 00:00:26,370 --> 00:00:29,070 Essentially, we want to get back to known good 15 15 00:00:29,070 --> 00:00:31,950 and we want to prevent an incident from happening again. 16 16 00:00:31,950 --> 00:00:33,720 Now, one of the things about recovery 17 17 00:00:33,720 --> 00:00:35,910 that you have to realize is it is the longest 18 18 00:00:35,910 --> 00:00:39,120 and most challenging part of your instant response. 19 19 00:00:39,120 --> 00:00:41,400 Recovery is focused on returning your systems 20 20 00:00:41,400 --> 00:00:45,000 and networks to a normal state of health and operations. 21 21 00:00:45,000 --> 00:00:46,650 This may involve restoring the systems 22 22 00:00:46,650 --> 00:00:48,030 from a known good backup, 23 23 00:00:48,030 --> 00:00:49,980 completely reinstalling your operating system, 24 24 00:00:49,980 --> 00:00:51,750 or even buying a brand new piece 25 25 00:00:51,750 --> 00:00:55,200 of equipment to replace a now-untrusted device. 26 26 00:00:55,200 --> 00:00:57,540 In addition to these basic recovery actions, 27 27 00:00:57,540 --> 00:01:00,450 you also need to go forward and harden those devices, 28 28 00:01:00,450 --> 00:01:02,580 change the passwords, increase the security 29 29 00:01:02,580 --> 00:01:04,470 at the network perimeter and the host level, 30 30 00:01:04,470 --> 00:01:07,200 and ensure that whatever was able to break into your network 31 31 00:01:07,200 --> 00:01:09,990 and infect it cannot get back in again. 32 32 00:01:09,990 --> 00:01:12,420 This is what recovery is all about. 33 33 00:01:12,420 --> 00:01:16,080 Now, let's talk about a few examples of instant recovery. 34 34 00:01:16,080 --> 00:01:18,360 Let's assume we had a database breach. 35 35 00:01:18,360 --> 00:01:19,680 Somebody was able to go in 36 36 00:01:19,680 --> 00:01:21,690 and delete data from your database. 37 37 00:01:21,690 --> 00:01:23,700 Well, how are you going to recover from that? 38 38 00:01:23,700 --> 00:01:24,750 The first thing you're going to do 39 39 00:01:24,750 --> 00:01:27,210 is do a continuous backup or replication 40 40 00:01:27,210 --> 00:01:30,210 from a known good backup to bring all that data back. 41 41 00:01:30,210 --> 00:01:31,170 Now, that's great 42 42 00:01:31,170 --> 00:01:32,910 and it's going to make sure everything is back, 43 43 00:01:32,910 --> 00:01:34,800 but have you gone back and figured out 44 44 00:01:34,800 --> 00:01:37,320 how they got into your database in the first place 45 45 00:01:37,320 --> 00:01:39,060 and corrected all those issues? 46 46 00:01:39,060 --> 00:01:41,370 Those are things we have to think about inside of recovery 47 47 00:01:41,370 --> 00:01:43,560 and as we take our recovery actions. 48 48 00:01:43,560 --> 00:01:45,990 Another example might be if your system was taken down 49 49 00:01:45,990 --> 00:01:48,390 by a distributed denial of service attack. 50 50 00:01:48,390 --> 00:01:50,940 Now again, we're going to recover very quickly 51 51 00:01:50,940 --> 00:01:54,510 by bringing those systems back online once the attack stops. 52 52 00:01:54,510 --> 00:01:57,240 But how do we make sure that we're in a good position, 53 53 00:01:57,240 --> 00:01:59,220 that we can't get taken down again? 54 54 00:01:59,220 --> 00:02:01,890 We need to go through recovery actions and system hardening, 55 55 00:02:01,890 --> 00:02:03,120 and make sure that we can have ways 56 56 00:02:03,120 --> 00:02:05,850 to protect ourself from a future attack. 57 57 00:02:05,850 --> 00:02:08,940 Or maybe we had an employee who clicked on a phishing link 58 58 00:02:08,940 --> 00:02:10,680 and that installed some malware, 59 59 00:02:10,680 --> 00:02:13,050 some kind of virus on their system. 60 60 00:02:13,050 --> 00:02:15,240 Well, once we clean that one system out, 61 61 00:02:15,240 --> 00:02:17,520 how are we going to make sure that doesn't come back again, 62 62 00:02:17,520 --> 00:02:20,580 and that that employee has learned their lesson? 63 63 00:02:20,580 --> 00:02:22,170 All of these are things that we have to do 64 64 00:02:22,170 --> 00:02:25,200 inside of recovery as part of our actions. 65 65 00:02:25,200 --> 00:02:28,470 Remember, the recovery steps taken for a particular incident 66 66 00:02:28,470 --> 00:02:31,530 are going to depend greatly on the nature of the incident. 67 67 00:02:31,530 --> 00:02:32,700 All three of these examples 68 68 00:02:32,700 --> 00:02:34,260 have different steps that we're going to take 69 69 00:02:34,260 --> 00:02:36,210 because they're different types of incidents 70 70 00:02:36,210 --> 00:02:37,410 and it's important for you to remember 71 71 00:02:37,410 --> 00:02:38,970 that you have to tailor your response 72 72 00:02:38,970 --> 00:02:41,570 to the particular incident that you're dealing with.