SHIELD
S – Scope the Compromise
What was compromised? Which environment, device, application, vendor, account?
H – How It Happened
CVE, misconfiguration, stolen credentials, 0-day, insider activity?
I – Identify Adversary Actions
What did they do after access? Data theft, persistence, lateral movement, disruption?
E – Evaluate Business Impact
Revenue, cost, brand, legal, customer impact.
L – Level of Recovery Required
Clean files, remove malware, rebuild system, full reinstallation?
D – Determine Clean Restore Point
Where is the last trusted state? Backups, snapshots, golden images.
Complete SHIELD before restoring production.
| SHIELD | AAA |
| Scope | Analyze |
| How | Analyze |
| Actions | Analyze |
| Impact | Analyze |
| Recovery Level | Act |
| Restore Point | Act |
| Validation | Acknowledge |