Recovery plans focus on restoring systems, less on the order in which connections return.
The incident is contained. Now, what do you reconnect first?
Bring withdrawn connections back one at a time, on agreed evidence and authority, instead of all at once.
Cyber Incidents & Containment
Validate, Lock, Relay
0 industry Blueprints
Assessed for your environment
01 · The problem
Controlled Post-Incident Reconnection: what goes wrong.
After an incident, the pressure to restore everything at once is intense. Reconnecting too early, or all at once, can reintroduce the attacker or reinfect systems that were cleaned.
Why existing controls may leave it open
Connections are often restored in software from an environment that is still being verified.
It is hard to show afterwards who approved each reconnection and on what evidence.
02 · Firevault's approach
Control the selected connections.
Firevault works with your incident and service owners to agree the order in which connections return, the evidence required for each and who must approve it. Each selected connection is reconnected deliberately, one step at a time.
03 · Before and with Control
See the connections change.
The connections that were always available, and their intended state once Control is in place. Your own design depends on your environment.
Concept view · CP-05 Controlled Post-Incident ReconnectionFromRecovered systems
- Verified core servicesPhysically disconnected
- Systems still under reviewPhysically disconnected
- Essential servicesStays connected, assessed
ToLive business network
A simplified concept, not a network design. Device placement, connections and operating sequences are designed for your environment in Control Studio.
Request a Studio design session04 · The outcome
What changes for you.
What this Plan does not do: This Plan does not verify that a system is clean. Two-person approval and recording depend on the supporting access and logging systems in the validated design.
- Connections return in an agreed order, on agreed evidence.
- Systems still under review stay disconnected.
- Each reconnection is approved and recorded.
05 · Where it applies
Industries where this Plan fits.
Each industry Blueprint applies this Plan to its own systems, dependencies and safety considerations.
Other Plans in Cyber Incidents & Containment
06 · Your environment
After an incident, which connection would you trust to reconnect first, and on what evidence?
Firevault reviews the connections in your own environment with the people who own them, then designs the Plan for you in Control Studio.