Getting back to normal.
WHAT ORDER TO WORK IN
Close the entry point Change every credential Restore or rebuild affected systems Verify Monitor
WHY THAT ORDER
Restoring before closing the entry point reproduces the compromise.
FOR ACCOUNTS
Change credentials, end sessions, remove unauthorised access, restore settings, enable a second factor.
FOR DEVICES
Rebuilding from clean sources is more certain than cleaning.
FOR DATA
Restore from a backup predating the compromise.
Establish when it started before choosing which backup.
WHAT TO VERIFY AFTERWARDS
That the system behaves normally That no unauthorised access remains That backups are functioning
WHAT TO MONITOR
Closely, for several weeks.
A recurrence indicates the entry point was not closed.
WHAT TO RESTORE LAST
Access for others, once you are confident.
WHAT TO RECORD
What was rebuilt, what was restored, and from when.
