Contain, Eradicate or Recover?

About this interactive

Once the team knows what is wrong, it moves through three phases, in this order. Containment stops the problem spreading further. In the lesson's ransomware case the infected machine is isolated from the network. When the trouble comes from outside, containment stops the intruder's communication: a firewall rule, an IPS or IDS signature, an ACL, a DLP rule, a behavior rule or a script. Record what you put in place; often it is a temporary measure to deal with later. Eradication removes the threat altogether: deleting the malware, the attacker's files and anything left to bring it back. Simply removing a virus may miss something, which is why the lesson often reimages the machine: wipe it, so nothing survives. Recovery restores full function. The ransom is not paid; the encrypted files are restored from clean backups, and systems go back into service and are watched to make sure they stay clean. A quick test for each card: is it stopping the spread, removing the cause, or putting things back?

What you'll learn

Place an incident response action in containment (stop the spread), eradication (remove the threat) or recovery (restore full function)
Recognize the lesson's containment techniques against an outside intruder, such as firewall, IPS, ACL and DLP rules, and tell wiping an infected machine (eradication) from restoring its files (recovery)

Aligned to

CompTIA Security+

4.8 Explain appropriate incident response activities.

NIST 800-53

IR-4 Incident Handling

CompTIA CySA+

3.2 Given a scenario, perform incident response activities.

NIST CSF

RS.MI-01 Incidents are contained.

RS.MI-02 Incidents are eradicated.

RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process.

Key terms

Containment: The phase of incident response focused on limiting the spread and impact of a security incident to prevent further damage.
Eradication: The phase of incident response in which the root cause and components of an incident, such as malware, are completely removed from affected systems.
Recovery: The phase of incident response in which affected systems and services are restored to normal operation after an incident.
Reimaging: The process of wiping a compromised system and reinstalling the operating system and software from a clean image to ensure complete removal of threats.
Intrusion Prevention System: A system that monitors network traffic and actively blocks detected threats in real time.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.

Topics

Incident Response Containment Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →