3.2.4. Containment, Eradication, and Recovery
First Principle: Containment stops the bleeding, eradication removes the infection, and recovery restores normal operations. These must happen in sequence — eradicating without containment lets the attacker re-establish access, and recovering without eradication reintroduces the vulnerability.
Containment Actions (Immediate — Stop the Threat):
| Threat Type | Containment Action |
|---|---|
| Compromised EC2 | Apply quarantine SG (deny all inbound/outbound) |
| Compromised credentials | Revoke active sessions, disable access key |
| Compromised IAM user | Attach explicit deny-all policy |
| Data exposure (S3) | Apply deny-all bucket policy, block public access |
| DDoS attack | Activate Shield Advanced SRT, adjust WAF rules |
Containment should be proportionate: for a business-critical instance that can't go dark, scope the quarantine security group to the minimum internal flows the workload must keep and deny everything else, so the threat is contained while service continues. Verify containment in the ENI's VPC Flow Logs (new connection attempts should show REJECT). Security group changes don't interrupt connections that are already tracked, so add a NACL deny (stateless) when an active session must be cut immediately.
Eradication Actions (Thorough — Remove the Root Cause):
- Delete unauthorized IAM users, roles, and access keys created by the attacker
- Terminate compromised instances (AFTER forensic capture)
- Rotate all credentials that may have been exposed
- Patch the vulnerability that enabled initial access
- Remove any backdoors (Lambda functions, EC2 instances in unusual Regions)
Recovery Actions (Controlled — Restore Normal Operations):
- Deploy new, hardened instances from validated AMIs
- Restore data from verified clean backups (confirm backups weren't compromised)
- Re-enable services with enhanced monitoring
- Gradually remove containment controls as confidence increases
- Validate recovery with Resilience Hub assessments
⚠️ Exam Trap: Restoring from backups without verifying them is dangerous — if the attacker was present when backups ran, the backup may contain the backdoor. Always validate backup integrity before restoration.
Scenario: After containing a credential compromise, the eradication phase reveals the attacker created a Lambda function in ap-southeast-1 that runs every 5 minutes to re-create the compromised access key. Without checking all Regions during eradication, the attacker maintains persistent access.
Reflection Question: Why must eradication search ALL Regions and ALL accounts rather than just the ones where the initial compromise was detected?
