{"id":1775,"date":"2019-08-01T11:50:32","date_gmt":"2019-08-01T10:50:32","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1775"},"modified":"2020-08-03T16:07:57","modified_gmt":"2020-08-03T15:07:57","slug":"incident-response-eradication","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/08\/incident-response-eradication\/","title":{"rendered":"Incident Response Phases – Eradication"},"content":{"rendered":"

In a previous post<\/a> we discussed Incident Response (IR) processes and our preference is one that runs Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned (PICERL). In this post, we are going to be looking a bit more into the Eradication phase of IR.<\/p>\n

\"Incident
PICERL – Common incident response process \/ framework<\/figcaption><\/figure>\n

If you’ve got this far, you have identified that an incident took place. Then you carried out an awesome investigation to understand what happened. Consequently, you were able to contain the attack. Now you need to get the attackers out. You need to eradicate them from your environment. <\/p>\n

Eradication<\/h2>\n

Containment is a short term solution. Now we are looking at a long-term solution. In other words, we want to get the attacker completely out. In addition, we want to keep them out in the future. It is important to remember that every incident is different. As a result of this, eradication measures can vary wildly. This is a good example of why it is critically important to investigate well. You can’t eradicate the attacker’s access if you dont know how they got it.<\/p>\n

Sometimes you might manage this by simply deleting malware. In other incidents, you might need to completely rebuild the domain. Ultimately, you need to deal with the information you have and act decisively. Although speed of response matters, you must never, ever, be hasty.<\/p>\n

Key Decisions<\/h3>\n

Previously we’ve talked about how important planning is. This is another phase where that is true. You cant plan the specific steps to be taken, but you can give guidance. For example, you need to give guidance on:<\/p>\n