📖 What is Eradication?
Eradication is the phase of the incident response process focused on completely removing the threat from the environment. This involves deleting malware, disabling breached user accounts, and closing the vulnerabilities that allowed the initial compromise to occur.
"Eradication must happen after containment; otherwise, the attacker might move laterally or trigger a 'dead man's switch' while you are deleting files."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Eradication?
- ▸ Root Cause Analysis (RCA) is critical to ensure the vulnerability is patched, preventing the attacker from immediately regaining access using the same exploit.
- ▸ Malware removal involves deleting malicious files or, more reliably, re-imaging systems from a known-good backup to eliminate hidden persistence mechanisms like rootkits.
- ▸ Account remediation requires disabling compromised accounts and forcing password resets across the environment to invalidate any stolen credentials the attacker may be using.
- ▸ Vulnerability remediation involves applying patches or configuration changes to the specific weaknesses that allowed the breach, ensuring the environment is hardened against repeat attacks.
- ▸ Sequencing is vital; eradication must only occur after containment is verified to prevent attackers from triggering destructive payloads or moving laterally upon detection.
🎯 How does Eradication appear on the CS0-003 Exam?
You may be asked to identify the correct incident response phase when a security analyst is tasked with deleting a malicious web shell and patching the underlying CMS vulnerability.
A scenario might describe a system that has been isolated from the network; you must determine the next logical step to remove the threat before returning to production.
Expect questions where you must distinguish between containment (stopping the spread) and eradication (removing the cause) when selecting the best action for a compromised server.
❓ Frequently Asked Questions
Why is re-imaging often preferred over manual malware removal?
Manual removal can miss sophisticated persistence mechanisms like bootkits or hidden registry keys. Re-imaging from a known-good gold image ensures a completely clean state and provides higher confidence that the threat is gone.
Can eradication happen simultaneously with containment?
While some tasks overlap, eradication should generally follow containment. If you start deleting files before isolating the system, the attacker may notice the activity and deploy ransomware or wipe logs in retaliation.