Respond to incidents and recover
Prepare, contain, eradicate and recover - and make sure backups really work.
- Describe the incident response life cycle and how it fits NIST CSF 2.0
- Choose containment actions that limit harm and keep evidence
- Check backups against the 3-2-1 rule and measure response times
Incidents are a when, not an if. Good response is mostly preparation: knowing who decides, how to reach them (when email might be compromised), what to log and where backups are.
NIST SP 800-61 Rev. 3 (2025) frames incident response through the six CSF 2.0 functions: Govern, Identify, Protect prepare you; Detect spots incidents; Respond handles them (analyze, contain, eradicate, communicate); Recover restores operations - and lessons learned feed back into everything. The classic phases still describe the work during an incident:
- Detection and analysis - is this real? What’s affected? How did it start?
- Containment - stop it spreading: isolate machines, disable accounts, block addresses.
- Eradication - remove the cause: malware, backdoors, the stolen credentials.
- Recovery - restore from clean backups, monitor closely.
- Lessons learned - a blame-free review that improves defenses.
WannaCry: ransomware that spread as a worm
WannaCry used vulnerabilities in Windows SMBv1 to move between reachable computers and encrypt files. Microsoft had already released the MS17-010 security update.
- 01An unpatched machine exposes a vulnerable SMBv1 service.
- 02The worm exploits it and searches for other reachable machines.
- 03Ransomware encrypts files and interrupts work.
- 04Responders isolate infected hosts, patch, and restore clean data.
Try it
Up to 15 XPContain, eradicate or recover?
Ransomware hit the office file server. Sort each action into its phase.
“Disconnect the infected server from the network (but don’t power it off)”
“Disable the compromised account the attackers used”
“Remove the attackers’ scheduled task and backdoor account”
“Reset every credential that was on the server”
“Restore files from last night’s immutable backup”
“Watch the restored server closely for a few weeks”
Backups that actually save you
Ransomware gangs go after backups first. The 3-2-1 rule: keep at least 3 copies of data, on 2 different kinds of storage, with 1 copy offsite. Many teams add 1 copy that’s immutable or offline (can’t be changed or deleted, even by an admin account), and 0 errors in restore tests.
A backup you’ve never restored is a hope, not a plan. Test restores regularly and time them - can you meet the business’s recovery time?
Practice: review a backup plan
Try it
Up to 15 XPWould this survive ransomware?
Ransomware operators go after backups first. Click the weak points in this plan.
Click every suspicious section. There are 3.
Practice: run a tabletop exercise
Try it
Up to 15 XPRansomware at 7:40 a.m.
Teams rehearse incidents out loud before they happen. You’re leading the response, so make the calls and see where they lead.
- Help deskThree people can’t open their files, and there’s a ransom note on the shared drive. What do we do?
What do you say?
Key takeaways
Prepare roles, contacts and trusted channels before you need them.
Contain first while preserving evidence; then eradicate the cause and recover from clean backups.
Follow 3-2-1 (plus an immutable copy) and test restores.
Lesson quiz
6 questions · pass with 5 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…