Recovery Validation
Definition
The verification process that confirms a restored system is clean, correctly configured, and free from residual attacker access. Distinct from eradication, which removes the threat, and from recovery, which restores system state.
- Stage
- Post-incident response
- Confirms
- System clean and correctly configured
- Distinct from
- Eradication and recovery
- Purpose
- Rule out residual attacker access
Common questions
Why isn't restoring a system from a clean backup sufficient without a separate validation step?+
Eradication and restoration can miss persistence mechanisms such as scheduled tasks, altered credentials, or backdoors reintroduced through the same vulnerability, so validation independently checks the restored system's configuration and monitors for signs the attacker retained access.
What kind of evidence does an incident responder look for during recovery validation?+
They typically review configuration baselines against known-good states, check for unexpected accounts or scheduled processes, and monitor logs and network traffic for indicators of continued compromise before declaring the system safely returned to service.
Related terms
- Baseline Comparison
- Comparison of a recovered system's current state, including running processes, network connections, scheduled tasks, and file hashes, against a known-good reference state...
- Extended Monitoring Window
- A defined period of heightened detection sensitivity following recovery, during which security operations maintain increased logging, alert thresholds, and analyst attention. Ends...
- Honeytoken
- A synthetic credential, document, or data record placed in a monitored location. Any attempt to use or access the honeytoken is an...
- Recurrence
- Re-establishment of attacker access or re-execution of the same attack vector after the prior incident has been eradicated. Recurrence triggers the incident...
- Tripwire
- A deliberately placed artefact or detection rule designed to fire only if an attacker returns or residual malware reactivates. Examples include canary...