5.2.3. Incident Containment, Eradication, and Recovery
💡 First Principle: The fastest possible containment action is rarely the best one — shutting a system down instantly can destroy the volatile evidence needed to understand the attack, and can cause more business disruption than a more measured containment strategy would have.
Containment strategy has to weigh stopping active damage against preserving forensic evidence (much of which lives in volatile memory that a hard shutdown erases) and against unnecessary business disruption (isolating a system from the network often achieves containment without the evidence loss or downtime of a full shutdown). Eradication removes the root cause identified during investigation — not just the visible symptom — and recovery restores normal operation only after eradication is verified complete, validated against a known-good state rather than simply "turned back on."
⚠️ Exam Trap: Immediate system shutdown is often assumed to be the correct first containment action. The correct answer weighs shutdown against evidence preservation and business continuity — network isolation or other measured containment is frequently the better choice.
⚠️ Exam Trap: The incident is sometimes assumed to be over once affected systems are restored. Recovery restores service; it does not by itself explain why the incident happened or prevent recurrence — that requires the post-incident review covered in 5.2.5.
Reflection Question: An analyst wants to immediately power off a compromised server to "stop the bleeding." What forensic evidence might this destroy, and what containment alternative would preserve it while still stopping the spread?
