Removing the threat and its artefacts from affected systems during incident response.
Eradication is the incident response phase where the threat is removed from the environment—malware deleted, backdoors removed, vulnerabilities patched, and compromised credentials changed. Eradication must be thorough; incomplete eradication allows attackers to return. This phase may involve rebuilding systems from clean images rather than attempting to clean infected systems. Eradication should address root cause, not just symptoms.
Why It Matters
The DSC Perspective:
Incomplete eradication leads to reinfection. Ensure all traces of compromise are removed before returning to normal operations. Sometimes rebuilding is more reliable than cleaning.