Recovery

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 41 of 43.

After the attacker has been stopped and their changes removed, staff need to get back to work. This stage is called recovery. It includes restoring safe access and undoing blocks that were applied by mistake.

For example, suppose Sam has checked Priya's account and home IP address, and confirmed that an invoice was genuine. You can enable her account, release the invoice from quarantine and unblock her home address:

seclab enable priya

You should see:

Enabled priya. They can log in again.

seclab release m7

You should see:

Released m7 back to the inboxes.

seclab unblock 192.0.2.70

You should see:

Unblocked 192.0.2.70.

Priya can now sign in from home and read the invoice again. Restore only the items that have been checked. Accounts still under investigation should stay disabled, and known phishing emails should stay in quarantine.

Challenge

Easy

Ticket from Dana, CEO

Sam's message lists the checks we completed. An employee's account, their home address and a real supplier invoice were blocked by mistake. Restore those items and mark the invoice safe. Keep the accounts still under investigation disabled and leave the known phishing emails in quarantine.

Try it yourself

Terminal

Recovery

All lessons in Security Fundamentals