Incident Response: Containment vs Eradication vs Recovery
Containment limits damage, eradication removes the cause, and recovery returns systems to normal operation.
Containment
Containment limits spread and damage, for example by isolating hosts, disabling accounts, blocking indicators, or segmenting affected systems.
Eradication
Eradication removes malicious code, compromised accounts, vulnerable components, persistence mechanisms, and other root causes that would allow the incident to continue or return.
Recovery
Recovery restores clean systems and services, monitors for recurrence, validates business functionality, and gradually returns operations to normal.
Exam strategy
Ask whether the action is stopping spread, removing the cause, or restoring service. Those map to containment, eradication, and recovery.
The takeaway
Containment limits impact, eradication removes the threat, and recovery safely restores normal operations.
Related Summit resources
FAQ
Is isolating an infected server containment?
Yes.
Is removing malware eradication?
Yes.
Is returning a clean system to production recovery?
Yes.