security-incident-recovery
Security Incident Recovery
Guides post-incident recovery from security breaches using a 4-phase process: appoint a Remediation Lead in parallel with investigation, scope the full blast radius, build a structured recovery checklist, and execute remediation — including isolation, clean rebuilds, credential rotation, and postmortem. Incorporates a decision framework for eject-vs-mitigate-vs-rebuild choices, four key adversarial-thinking questions, and technical debt tracking for short-term bypasses. Covers three worked scenarios ranging from opportunistic cloud compromise to targeted APT with financial backdoor. Output: recovery checklist, credential rotation plan, and postmortem with prioritized action items.
Prerequisite: The Incident Management at Google (IMAG) process must be running with an Incident Commander (IC) and an Operations Lead (OL) already staffed (security-incident-command). This skill picks up from the point at which enough is known about the attack to begin parallel recovery planning.
When to Use
- Executing recovery after a confirmed security breach, intrusion, or account compromise
- Scoping which systems, accounts, and data are affected and need remediation
- Building the recovery checklist before executing cleanup
- Deciding whether to eject the attacker now or continue observing their activity
- Rotating credentials, secrets, and cryptographic keys following a breach
- Conducting a postmortem that distinguishes overnight tactical fixes from strategic long-term changes
- Recovering from attacks where the attacker may still be present and watching the response