In this section of the course,
we'll focus on the activities involved
in cleaning up and restoring systems
following a penetration test.
Clean up and restoration
are important phases in a penetration test,
as they're designed to return the system to normal operation
and reduce future vulnerability.
These activities ensure
that all traces of the penetration test are removed
and that systems are restored to their original state
or an improved state for better security.
The domain in this section
will be centered around Domain 5:
Post-exploitation and Lateral Movement.
Objective 5.4 will be our main focus in this section,
which states that we should be able to explain
cleanup and restoration activities.
We'll start things off with a Persistence Removal,
where you'll learn how to identify and remove
mechanisms set up by attackers to maintain access to system,
ensuring they cannot regain entry after the cleanup process.
Next, we'll discuss Reverting Configuration Changes.
This involves restoring configurations and settings
back to their original or intended state,
which includes undoing any unauthorized changes
made during the testing.
Following that, Created Credentials Removal will be covered.
We'll explore the process of identifying and removing
any user accounts or credentials
that were created during our test
to prevent future unauthorized access.
The Removal of Testing Tools is up next,
where you will learn how to carefully remove
any software, scripts, or tools
used during penetration testing
that could be used maliciously if left on the system.
Decommissioning Test Infrastructure
will be followed after that,
which involves taking down any temporary system
or networks set up for testing purposes
to ensure that they cannot be exploited
after the testing is completed.
After that, Artifact Preservation will be discussed,
focusing on the proper collection and preservation
of logs, breached data, and other things that could be used
for further analysis, legal purposes,
or to improve security as a whole.
And to wrap things up,
we will discuss Secure Data Destruction.
In this lesson, you'll learn about methods
to securely delete data
that was temporarily used or created during testing,
ensuring it cannot be recovered.
Finally, we'll take a short quiz to see what you learned
during this section of the course,
and review each of those quiz questions fully
to ensure that you can explain why each answer was right.
So, let's begin our section on Cleanup and Restoration.