Please enable JavaScript.
Coggle requires JavaScript to display documents.
🚨 NIST SP 800-61 Incident Response Lifecycle - Coggle Diagram
🚨 NIST SP 800-61 Incident Response Lifecycle
🟢 Phase 5: Recovery (Enterprise Linux Implementation)
📌 Recovery Definition
Recovery means restoring affected systems, applications, services, and data
after security incident while ensuring system is secure before returning to production
Main Goals
Restore Business Operations
Remove attacker persistence
Verify system integrity
Validate security controls
Monitor for reinfection
Document recovery actions
🏢 Enterprise Recovery Strategy
Recovery Decision Process
Incident Commander Approval
Determines when recovery starts
System Owner Approval
Application owner confirms business readiness
Security Team Approval
Confirms security requirements completed
Change Management Approval
Production changes follow ITIL/change process
🔎 Recovery Preparation Before Restoration
System Assessment
Identify Affected Assets
Linux Servers
Web Servers
Database Servers
Application Servers
Domain Controllers
SIEM Servers
Network Devices
Firewalls
Routers
Switches
Cloud Resources
AWS EC2
Azure VM
Kubernetes Nodes
Collect Incident Information
Incident Ticket
Example
INC-2026-001
Evidence Location
Logs
/var/log/
SIEM Evidence
Elasticsearch
Splunk
QRadar
Forensic Images
Disk image
Memory dump
💾 Backup Validation
Backup Purpose
Restore clean known-good state
Backup Types
Full Backup
Complete system backup
Incremental Backup
Changes since previous backup
Snapshot
VM storage snapshot
Database Backup
SQL dump
Replication backup
Linux Backup Locations
/backup
/var/backups
Remote Backup Server
Enterprise Backup Solutions
Veeam
Commvault
NetBackup
Verify Backup Integrity
Check Backup Hash
Command
sha256sum backup.tar.gz
Compare Hash
sha256sum -c checksum.txt
Test Restore
Restore backup in isolated environment
Validate:
Files
Permissions
Applications
Database
🧹 Recovery Step 1: System Cleaning
Objective
Remove attacker access
Remove malware
Remove persistence mechanisms
Check Unauthorized Users
Linux User Database
/etc/passwd
/etc/shadow
/etc/group
Commands
cat /etc/passwd
cat /etc/group
sudo awk -F: '$3>=1000 {print $1}' /etc/passwd
Check User SSH Keys
Location
~/.ssh/authorized_keys
/root/.ssh/authorized_keys
Command
cat ~/.ssh/authorized_keys
Remove attacker key
rm ~/.ssh/authorized_keys
Check Scheduled Tasks
Cron Persistence
Locations
/etc/crontab
/etc/cron.d/
/var/spool/cron/
Commands
crontab -l
ls -la /etc/cron.d/
Check System Services
Persistence through systemd
Location
/etc/systemd/system/
/usr/lib/systemd/system/
Commands
systemctl list-unit-files
systemctl list-units --type=service
Disable malicious service
systemctl stop malicious.service
systemctl disable malicious.service
🔐 Recovery Step 2: Security Hardening
Patch Operating System
Red Hat Enterprise Linux
yum update
dnf update
Ubuntu
apt update
apt upgrade
Verify Kernel Version
Command
uname -r
Remove Vulnerable Software
RPM Systems
rpm -qa
dnf remove package_name
Debian Systems
dpkg -l
apt remove package_name
🔥 Firewall Recovery
Purpose
Restore network security controls
Linux Firewall
firewalld
Check Status
systemctl status firewalld
View Rules
firewall-cmd --list-all
Add Rule
firewall-cmd --add-service=https --permanent
Reload
firewall-cmd --reload
iptables
View Rules
iptables -L -n -v
🛡️ SELinux Recovery
Purpose
Ensure mandatory access control protection
Check SELinux
sestatus
Restore Security Context
Command
restorecon -Rv /var/www
Check Labels
ls -Z /var/www/html
Fix Wrong Context
semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
restorecon -Rv /web
🔑 Identity and Access Recovery
Password Reset
passwd username
Force Password Expiration
chage -d 0 username
Remove Compromised Accounts
userdel username
SSH Security
Configuration
/etc/ssh/sshd_config
Disable Root Login
PermitRootLogin no
Restart SSH
systemctl restart sshd
🔄 Recovery Step 3: Restore Services
Service Validation
Check Service Status
systemctl status service_name
Start Service
systemctl start service_name
Enable Service
systemctl enable service_name