Please enable JavaScript.
Coggle requires JavaScript to display documents.
🚨 NIST SP 800-61 🟢 Phase 5: Recovery - Coggle Diagram
🚨 NIST SP 800-61 🟢 Phase 5: Recovery
🟢 Phase 5: Recovery (Enterprise Linux Implementation)
📌 Recovery Definition
Recovery means restoring affected systems, applications, services, and data
after security incident while ensuring system is secure before returning to production
Main Goals
Restore Business Operations
Remove attacker persistence
Verify system integrity
Validate security controls
Monitor for reinfection
Document recovery actions
🏢 Enterprise Recovery Strategy
Recovery Decision Process
Incident Commander Approval
Determines when recovery starts
System Owner Approval
Application owner confirms business readiness
Security Team Approval
Confirms security requirements completed
Change Management Approval
Production changes follow ITIL/change process
🔎 Recovery Preparation Before Restoration
System Assessment
Identify Affected Assets
Linux Servers
Web Servers
Database Servers
Application Servers
Domain Controllers
SIEM Servers
Network Devices
Firewalls
Routers
Switches
Cloud Resources
AWS EC2
Azure VM
Kubernetes Nodes
Collect Incident Information
Incident Ticket
Example
INC-2026-001
Evidence Location
Logs
/var/log/
SIEM Evidence
Elasticsearch
Splunk
QRadar
Forensic Images
Disk image
Memory dump
💾 Backup Validation
Backup Purpose
Restore clean known-good state
Backup Types
Full Backup
Complete system backup
Incremental Backup
Changes since previous backup
Snapshot
VM storage snapshot
Database Backup
SQL dump
Replication backup
Linux Backup Locations
/backup
/var/backups
Remote Backup Server
Enterprise Backup Solutions
Veeam
Commvault
NetBackup
Verify Backup Integrity
Check Backup Hash
Command
sha256sum backup.tar.gz
Compare Hash
sha256sum -c checksum.txt
Test Restore
Restore backup in isolated environment
Validate:
Files
Permissions
Applications
Database
🧹 Recovery Step 1: System Cleaning
Objective
Remove attacker access
Remove malware
Remove persistence mechanisms
Check Unauthorized Users
Linux User Database
/etc/passwd
/etc/shadow
/etc/group
Commands
cat /etc/passwd
cat /etc/group
sudo awk -F: '$3>=1000 {print $1}' /etc/passwd
Check User SSH Keys
Location
~/.ssh/authorized_keys
/root/.ssh/authorized_keys
Command
cat ~/.ssh/authorized_keys
Remove attacker key
rm ~/.ssh/authorized_keys
Check Scheduled Tasks
Cron Persistence
Locations
/etc/crontab
/etc/cron.d/
/var/spool/cron/
Commands
crontab -l
ls -la /etc/cron.d/
Check System Services
Persistence through systemd
Location
/etc/systemd/system/
/usr/lib/systemd/system/
Commands
systemctl list-unit-files
systemctl list-units --type=service
Disable malicious service
systemctl stop malicious.service
systemctl disable malicious.service
🔐 Recovery Step 2: Security Hardening
Patch Operating System
Red Hat Enterprise Linux
yum update
dnf update
Ubuntu
apt update
apt upgrade
Verify Kernel Version
Command
uname -r
Remove Vulnerable Software
RPM Systems
rpm -qa
dnf remove package_name
Debian Systems
dpkg -l
apt remove package_name
🔥 Firewall Recovery
Purpose
Restore network security controls
Linux Firewall
firewalld
Check Status
systemctl status firewalld
View Rules
firewall-cmd --list-all
Add Rule
firewall-cmd --add-service=https --permanent
Reload
firewall-cmd --reload
iptables
View Rules
iptables -L -n -v
🛡️ SELinux Recovery
Purpose
Ensure mandatory access control protection
Check SELinux
sestatus
Restore Security Context
Command
restorecon -Rv /var/www
Check Labels
ls -Z /var/www/html
Fix Wrong Context
semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
restorecon -Rv /web
🔑 Identity and Access Recovery
Password Reset
passwd username
Force Password Expiration
chage -d 0 username
Remove Compromised Accounts
userdel username
SSH Security
Configuration
/etc/ssh/sshd_config
Disable Root Login
PermitRootLogin no
Restart SSH
systemctl restart sshd
🔄 Recovery Step 3: Restore Services
Service Validation
Check Service Status
systemctl status service_name
Start Service
systemctl start service_name
Enable Service
systemctl enable service_name
Application Validation
Test:
Login
Database connection
API response
User access
🗄️ Database Recovery
Validate Database
MySQL
systemctl status mysql
PostgreSQL
systemctl status postgresql
Restore Database
MySQL
mysql database < backup.sql
PostgreSQL
psql database < backup.sql
Check Database Logs
/var/log/mysql/
/var/log/postgresql/
🌐 Web Server Recovery
Apache
Configuration
/etc/httpd/
Check
apachectl configtest
Restart
systemctl restart httpd
Nginx
Configuration
/etc/nginx/
Check
nginx -t
Restart
systemctl restart nginx
📊 SIEM Monitoring After Recovery
Purpose
Detect attacker return
Linux Logs
Authentication
/var/log/auth.log
/var/log/secure
System Logs
/var/log/messages
journalctl
Commands
Recent Authentication
last
lastb
Failed Login Attempts
journalctl -u sshd
🤖 Enterprise Detection Tools
File Integrity Monitoring
AIDE
Configuration
/etc/aide.conf
Check
aide --check
Rootkit Detection
chkrootkit
chkrootkit
rkhunter
rkhunter --check
Endpoint Detection Response
CrowdStrike
SentinelOne
Microsoft Defender
🧪 Recovery Validation Testing
Security Validation
Vulnerability Scan
Nessus
OpenVAS
Trivy
CIS Benchmark Check
Lynis
OpenSCAP
Application Testing
Functional Test
Application works
Security Test
No unauthorized access
📈 Recovery Monitoring Period
Increased Monitoring
Usually:
24 hours
72 hours
7 days
30 days
Monitor
User Login
Network Connections
CPU Usage
New Processes
File Changes
Commands
Running Processes
ps aux
Network Connections
ss -tulpn
File Changes
find / -mtime -1
📝 Recovery Documentation
Record
Incident Timeline
Systems Restored
Commands Executed
Files Changed
Security Improvements
Lessons Learned
Evidence Preservation
Store:
Logs
Screenshots
Reports
Hash Values
Investigation Notes
🔁 Transition To Normal Operations
Final Approval
Security Team
Business Owner
System Administrator
Close Incident
Update Ticket
Archive Evidence
Generate Final Report
⭐ Enterprise Recovery Checklist
✅ Backup Verified
✅ Malware Removed
✅ Accounts Reviewed
✅ Passwords Reset
✅ Patches Applied
✅ Firewall Restored
✅ SELinux Verified
✅ Services Tested
✅ Monitoring Enabled
✅ Documentation Completed
🎯 Real Enterprise Example
Scenario
Linux Web Server Compromised
Recovery Flow
Isolate Server
Analyze Evidence
Remove Malware
Restore Clean Backup
Patch OS
Harden SSH
Verify SELinux
Restart Apache
Monitor SIEM
Close Incident