- [Voiceover] The incident mitigation process
brings an organization to a semi-stable point in time.
Where the security threat has passed and the organization
has resumed business operations
if they were otherwise disrupted.
Next incident responders enter the recovery
and reconstitution phase of incident response.
The goal of this phase is to remove any effects
of the incident and return the organization
to normal operating status
with all technology systems in place
and protected against future attacks.
This phase includes finalizing
the technical response to the incident.
The details of this technical response will vary
depending upon the type of the incident.
Some of the actions you may need to take
during the incident recovery effort
include rebuilding compromised systems,
removing malware from infected hosts,
disabling breached user accounts,
and restoring corrupted or deleted data.
These steps help administrators restore the company
to its normal operating state.
This isn't the only important technical process
that takes place as an incident response wraps up however.
In most cases an incident occurred because an attacker
exploited one or more vulnerabilities.
During the incident reconstitution effort,
administrators must identify
and remediate those vulnerabilities.
This may include actions such as applying security patches,
updating firewall rules,
implementing intrusion prevention systems,
and strengthening access control measures.
After all, if you simply restore systems from a backup
and bring yourself back to the state where you were
before an incident took place,
that state probably includes the same vulnerability
that started the incident in the first place.
You're just setting yourself up for another disaster.
The recovery and reconstitution effort
may require a significant amount of work
depending upon the nature of the incident.
It's not unusual to have a recovery effort
that takes weeks or months in the wake
of a serious security incident.
Responders should use a phased approach
that implements controls that deliver the greatest amount
of security in the shortest amount of time
following an incident
and then work through long-term changes over time.