Recovering and learning

Containment stops the bleeding. Recovery puts you back in business, without letting the attacker back in.

Find the way in

Before restoring, work out how the attacker got in: an outdated plugin, a leaked password, an exposed admin panel. Check web logs around the earliest sign of the attack. If you restore without closing the hole, you'll be breached again within days.

Rebuild, don't clean

On a compromised server you can never be sure you found everything. The safe path:

1. Build a fresh server from a clean image.
2. Deploy the application from known-good source, not from the infected server.
3. Restore data from a backup taken before the compromise, checked for planted files.
4. Use new credentials everywhere.

Watch closely

Monitor the new server more closely for several weeks: logins, outgoing connections and file changes.

The review

Within two weeks, hold a blameless review:

• What happened, on a timeline
• What went well and what slowed you down
• Three to five concrete actions, each with an owner and a date