Containment stops the bleeding; eradication removes the cause, and recovery returns systems to normal operation. Doing these thoroughly determines whether the attacker is truly gone or simply waiting to return. Many organizations have suffered a second incident within weeks because they cleaned the visible malware but left a backdoor, reused compromised passwords or restored infected backups.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.