Instructor: Recovery. 2 2
So at this point, we've covered eradication. 3 3
Now we're going to talk about recovery. 4 4
First for a quick review, 5 5
we talked about eradication and recovery 6 6
as the removal of the cause of the incident 7 7
and bringing the system back to a secure state. 8 8
Now, when we talk about recovery specifically, 9 9
we're talking about the actions taken 10 10
to ensure the hosts are fully reconfigured 11 11
to operate the business workflow 12 12
the way they were performing those things 13 13
before the incident occurred. 14 14
Essentially, we want to get back to known good 15 15
and we want to prevent an incident from happening again. 16 16
Now, one of the things about recovery 17 17
that you have to realize is it is the longest 18 18
and most challenging part of your instant response. 19 19
Recovery is focused on returning your systems 20 20
and networks to a normal state of health and operations. 21 21
This may involve restoring the systems 22 22
from a known good backup, 23 23
completely reinstalling your operating system, 24 24
or even buying a brand new piece 25 25
of equipment to replace a now-untrusted device. 26 26
In addition to these basic recovery actions, 27 27
you also need to go forward and harden those devices, 28 28
change the passwords, increase the security 29 29
at the network perimeter and the host level, 30 30
and ensure that whatever was able to break into your network 31 31
and infect it cannot get back in again. 32 32
This is what recovery is all about. 33 33
Now, let's talk about a few examples of instant recovery. 34 34
Let's assume we had a database breach. 35 35
Somebody was able to go in 36 36
and delete data from your database. 37 37
Well, how are you going to recover from that? 38 38
The first thing you're going to do 39 39
is do a continuous backup or replication 40 40
from a known good backup to bring all that data back. 41 41
Now, that's great 42 42
and it's going to make sure everything is back, 43 43
but have you gone back and figured out 44 44
how they got into your database in the first place 45 45
and corrected all those issues? 46 46
Those are things we have to think about inside of recovery 47 47
and as we take our recovery actions. 48 48
Another example might be if your system was taken down 49 49
by a distributed denial of service attack. 50 50
Now again, we're going to recover very quickly 51 51
by bringing those systems back online once the attack stops. 52 52
But how do we make sure that we're in a good position, 53 53
that we can't get taken down again? 54 54
We need to go through recovery actions and system hardening, 55 55
and make sure that we can have ways 56 56
to protect ourself from a future attack. 57 57
Or maybe we had an employee who clicked on a phishing link 58 58
and that installed some malware, 59 59
some kind of virus on their system. 60 60
Well, once we clean that one system out, 61 61
how are we going to make sure that doesn't come back again, 62 62
and that that employee has learned their lesson? 63 63
All of these are things that we have to do 64 64
inside of recovery as part of our actions. 65 65
Remember, the recovery steps taken for a particular incident 66 66
are going to depend greatly on the nature of the incident. 67 67
All three of these examples 68 68
have different steps that we're going to take 69 69
because they're different types of incidents 70 70
and it's important for you to remember 71 71
that you have to tailor your response 72 72
to the particular incident that you're dealing with.