NIST SP 800-61 5: Containment, Eradication, and Recovery

Execute Containment + Eradication + Recovery per NIST SP 800-61 Rev 2 Section 3.3. Containment Strategy (Section 3.3.1) must be chosen based on (a) potential damage to and theft of resources, (b) need for evidence preservation, (c) service availability requirements, (d) time and resources to implement the strategy, (e) effectiveness of the strategy (partial vs full), (f) duration of the solution (emergency workaround vs temporary vs permanent). Identify Attacking Hosts (Section 3.3.2) via attacker IP address validation + research via search engines + databases + incident response coordination centres + monitor possible communication channels (although NIST 800-61 cautions about attribution complexity). Eradication and Recovery (Section 3.3.4) must (a) eliminate components of the incident (delete malware + disable breached accounts + identify and mitigate exploited vulnerabilities), (b) recover systems to normal operation (restore from clean backup + rebuild systems + replace compromised files + install patches + change passwords + tighten network perimeter security with firewall rulesets and boundary router access control lists), (c) confirm normal functioning + remediate vulnerabilities that enabled the incident, (d) consider higher monitoring level for some time after recovery to verify completeness.