System Recovery and Clean Up

Learning outcomes:

• Identify common signs that a system has been compromised, and describe how to contain it and keep malware from spreading
• Compare cleaning an infected system with rebuilding it from a known good image, and explain when each is the better choice
• Explain how to preserve evidence and document an incident before cleaning up
• Describe how to verify that a system is clean and safe to return to production

Would you like to download my PowerPoint to follow along?

• Signs a System Is Compromised
• Slow performance, crashes, high CPU or network use
• Unknown programs, accounts or scheduled tasks
• Antivirus disabled, pop-ups, browser redirects
• Some infections show no signs at all
• Don't Panic, Follow a Plan
• Emergencies are when people make mistakes
• Have a checklist ready before you need it
• Follow your incident response plan if one exists
• The SANS Incident Handler's Handbook is a practical place to start
• Containment
• Disconnect from the network, but don't power off yet
• Stop the spread to other systems
• Change passwords from a clean device
• Preserving Evidence
• Why evidence matters: legal, insurance, and finding the root cause
• Memory disappears when you power off
• Take screenshots and notes, and record the timeline
• Chain of custody basics
• Documenting the Incident
• What happened, when, what was affected, what was done
• The documentation helps you next time, and auditors will ask for it
• Clean or Rebuild?
• Cleaning: faster, but you can't be sure it worked
• Rebuilding: slower, but you know the result is clean
• Industry rule of thumb: if in doubt, rebuild
• Rootkits and firmware infections mean rebuild
• Rebuilding from a Known Good Image
• Golden images and why they need to stay current
• Restore data from backups, not programs
• Check that the backups aren't infected too
• CISA's #StopRansomware Guide covers backups and recovery checklists
• Verifying the System Is Clean
• Scan with several tools
• Watch network traffic and logs after reconnecting
• Patch the hole that let the attacker in before going back to production
• NIST's Guide for Cybersecurity Event Recovery
• Personal Device Recovery
• What to do if your own computer or phone is infected
• Hit by ransomware? Check No More Ransom for free decryption tools
• Back up personal files regularly (3-2-1 rule)
• When to factory reset
• Check your accounts for unauthorized access afterwards
• Lessons Learned
• How did they get in, and how do we stop it next time?
• Blameless reviews: focus on fixing the process
• Update the plan and the training

Suggested Activities and Discussion Topics:

• Activity: given an infection scenario, decide whether to clean or rebuild and justify the decision
• Scenario 1: An employee in accounting reports pop-ups and a slow computer. Antivirus finds and removes a trojan, but the firewall logs show the machine has been connecting to an unknown IP address every night for the past two weeks. The employee has access to payroll and the company bank account. Clean or rebuild? What else needs to happen besides fixing the computer?
• Scenario 2: A student installs a free PDF converter on their personal laptop. Afterwards, the browser homepage has changed and there are ads everywhere. There is no work or school data stored on the laptop, and their files are backed up to the cloud. Clean or rebuild? Would your answer change if this were a work laptop?
• Discussion: what is your own backup plan for your personal files? Would it survive ransomware?
• Activity: use the example industry checklist to work through Scenario 1. Which steps can the company do right away? What would you add to the checklist?
• Activity: start from the example personal checklist and make your own version for your devices and accounts. Where are your backups? Which account would you secure first?
• Discussion: should a company ever pay a ransom? Does your answer change if it's a hospital and patient care is affected?

Would you like to see some more classes? Click here