Please enable JavaScript.
Coggle requires JavaScript to display documents.
5️⃣ Recovery Phase (Restore Normal Business Operations) - Coggle Diagram
5️⃣ Recovery Phase (Restore Normal Business Operations)
📌 Recovery Definition
Recovery = Returning affected systems back to a secure operational state
Goal:
Restore services
Remove attacker persistence
Validate security controls
Prevent re-infection
Return business operations safely
Recovery is NOT:
Simply rebooting server
Deleting suspicious files only
Restoring backup without investigation
Enterprise Standard:
NIST SP 800-61 Incident Response Lifecycle
ISO 27035 Incident Management
SANS Incident Response Process
5.1️⃣ Recovery Preparation
🏢 Enterprise Recovery Team
Incident Response Manager
Coordinates recovery activities
Linux Administrator
Performs system recovery
Security Analyst
Validates malware removal
Application Owner
Confirms application functionality
Business Owner
Approves service restoration
5.2️⃣ Identify System Recovery Priority
Critical Systems
Database Servers
Authentication Servers
Payment Systems
Production Applications
Important Systems
Internal Applications
Monitoring Servers
File Servers
Low Priority Systems
Test Servers
Development Systems
5.3️⃣ Step 1: Containment Verification Before Recovery
Purpose:
Ensure attacker no longer has access
Check Active Users
Command:
who
Example:
who
Check Logged Users
Command:
w
Check SSH Sessions
Command:
ss -tunap | grep ssh
Check Processes
Command:
ps aux
Check Network Connections
Command:
netstat -tulpn
5.4️⃣ Step 2: Malware and Persistence Removal
Check Startup Services
systemd Services
Path:
/etc/systemd/system/
Command:
systemctl list-unit-files
Disable Malicious Service
Command:
systemctl stop service_name
systemctl disable service_name
Check Cron Persistence
Cron = Scheduled task execution
Locations:
/etc/crontab
/etc/cron.d/
/var/spool/cron/
/var/spool/cron/crontabs/
Command:
crontab -l
Check SSH Persistence
File:
~/.ssh/authorized_keys
Command:
cat ~/.ssh/authorized_keys
Remove Unauthorized Keys
Command:
rm ~/.ssh/authorized_keys
5.5️⃣ Step 3: Patch and Harden System
Update Packages
RHEL/CentOS/Rocky Linux
Command:
dnf update -y
Ubuntu/Debian
Command:
apt update
apt upgrade -y
Check Kernel Version
Command:
uname -r
Security Configuration
Disable Root SSH Login
File:
/etc/ssh/sshd_config
Setting:
PermitRootLogin no
Restart SSH
Command:
systemctl restart sshd
Enable Firewall
RHEL:
firewall-cmd --state
Ubuntu:
ufw status
5.6️⃣ Step 4: Restore From Backup
Backup Verification
Check Backup Integrity
Verify Backup Date
Verify Backup Is Malware Free
Restore Methods
File Restore
Command:
rsync -av backup/ /data/
Disk Image Restore
Tools:
Clonezilla
Veeam
Cloud Restore
AWS Snapshot
Azure Backup
5.7️⃣ Step 5: Validate Recovery
System Health Check
CPU
top
Memory
free -h
Disk
df -h
Services
systemctl --failed
Logs
/var/log/messages
/var/log/secure
journalctl
5.8️⃣ Step 6: Security Validation
Vulnerability Scan
Nessus
OpenVAS
Qualys
File Integrity Check
AIDE
Commands:
aide --init
aide --check
Rootkit Detection
chkrootkit
rkhunter
5.9️⃣ Step 7: Monitoring After Recovery
SIEM Monitoring
Elastic SIEM
Splunk
QRadar
Monitor:
Failed SSH Login
Privilege Escalation
New Users
New Services
File Changes
5.🔟 Recovery Documentation
Incident Report
Timeline
Root Cause
Actions Taken
Evidence Collected
Lessons Learned
✅ Recovery Complete
Business Service Restored
Security Controls Verified
Monitoring Enabled
Incident Closed