Secure After Compromise — Post-Incident Hardening

This page is the post-incident hardening checklist — what to do after the immediate triage in the Incident Response Guide is done and the bleeding has stopped. If you are still in active loss, do not start here — go to the IR Guide and find the scenario that matches.

When to read this page

• The attacker is no longer in your accounts / devices.
• You’ve stopped any active money loss.
• You’ve made the urgent reports (bank, IC3, CCRI, security manager, whoever).
• You want to prevent the next attempt — because an adversary who got in once often retries within weeks.

Devices

Reinstall when in doubt

For any compromise where an attacker had code execution (malware, remote-access tool, ransomware, infostealer), the only fully trustworthy outcome is reinstall from clean media.

• Download the OS installer fresh from the vendor — Apple, Microsoft, your Linux distro. Verify SHA-256 if the vendor publishes one.
• Reinstall on a wiped disk (full format, not “keep my files”).
• Do not restore from a backup taken after the compromise; persistence may ride along.
• Re-flash external drives and USB sticks that touched the compromised system.
• Verify firmware updates (UEFI/BIOS) are current — sophisticated attackers sometimes implant at firmware level.

Encrypt the new install

• macOS — enable FileVault (System Settings → Privacy & Security → FileVault).
• Windows — enable BitLocker on the system drive (Settings → Privacy & Security → Device encryption / BitLocker drive encryption).
• Linux — use LUKS during install; cannot easily be added after.
• Mobile — modern iOS and Android are encrypted by default once a screen-lock passcode is set. Use a 6+ digit PIN at minimum, alphanumeric preferred for high-risk users.

Encryption protects you when the device is physically lost or stolen, not when an attacker has live access.

Lock down the boot/recovery path

• Set a firmware/BIOS password if your platform supports it (most x86 laptops do).
• macOS — enable “Allow apps downloaded from App Store and identified developers” only; sign-in to the firmware-protected recovery owner account.
• Windows — Secure Boot on, TPM 2.0 enabled.

Reinstall apps deliberately

• Install only what you need. Reduced attack surface = fewer footholds for the next attempt.
• For each app: get it from the official vendor or your OS app store. Verify the publisher. Beware of search-ad scams that point to fake installer sites.
• Audit app permissions — does this app really need contacts / camera / microphone / location?

Endpoint protection

• macOS / Windows — built-in defenses (XProtect/Gatekeeper, Microsoft Defender) are reasonable baselines. Add a second opinion scanner periodically (Malwarebytes free).
• Linux — there is no consumer AV worth running; rely on package-manager-only installs, AppArmor/SELinux profiles, and minimal exposed services.
• Mobile — Android: install only from Play Store or F-Droid; deny sideload. iOS: avoid TestFlight invites from strangers; jailbroken devices lose protection.

Accounts

Inventory your accounts

After a breach, you will catch yourself thinking “I never use that account, it doesn’t matter.” Often that account is what the attacker pivots through. Take 30 minutes to inventory:

• Export your password manager. Sort by domain.
• Cross-reference with haveibeenpwned.com — emails associated with breaches.
• Decide for each account: rotate, delete, or keep as-is. Delete > rotate when the account is unused; one fewer vector.

Rotate, in the right order

If you’ve already done the urgent rotation in the IR Guide → Path A, the long-tail order looks like:

1. Tier 1 — Identity infrastructure (rotate first): primary email, mobile carrier, password manager master, cloud provider root, code-signing keys.
2. Tier 2 — High-value targets: bank, brokerage, payment apps, crypto exchanges, employer SSO.
3. Tier 3 — Social and impersonation surface: social media, messaging accounts, dating apps.
4. Tier 4 — Everything else: shopping, subscriptions, forum logins. Bulk-rotate over a week.

Use unique, long, random passwords for each. A password manager makes this painless.

Upgrade MFA

After a compromise is a good time to move from weak to strong MFA:

• SMS is the weakest (SIM-swap vulnerable). Acceptable when nothing better is offered.
• App-based TOTP (Aegis, Raivo, Google Authenticator, Authy) is good for most.
• Hardware security keys (YubiKey 5, Solokey, Nitrokey, Google Titan) are the gold standard. Get two — one to carry, one as a backup in a secure location. Most major services support them (Google, Microsoft, Apple, GitHub, AWS, Cloudflare, password managers).
• Passkeys / FIDO2 are phishing-resistant; turn them on where supported.

See the MFA Guide for setup.

Audit recovery paths

The attacker may have added their own recovery email / phone / OAuth app to your accounts as a re-entry mechanism. Check on every important account:

• Recovery email — is it still you?
• Recovery phone — is it still your number?
• Trusted devices — anything unfamiliar?
• Connected apps / OAuth — revoke anything stale or unfamiliar.
• App-specific passwords — revoke all and regenerate only what you actively need.
• API keys — rotate, especially long-lived ones.

Revoke sessions one more time

Right after rotation: sign-out-everywhere on every account. See Revoke sessions in the IR Guide.

Identity hygiene

Freeze your credit (if you haven’t already)

Free, easy, reversible at all three bureaus. See Freeze credit in the IR Guide.

Remove yourself from data brokers

Adversaries who got close once often start by buying your data. Reducing the footprint helps next time:

• Big Ass Data Broker Opt-Out List — community-maintained, free.
• Commercial services (DeleteMe, Kanary, Optery) — pay for ongoing removal.
• Manually opt out of the big aggregators: Spokeo, BeenVerified, Whitepages, Intelius, MyLife, FastPeopleSearch, TruePeopleSearch.

Set up monitoring

• Have I Been Pwned — register your emails for notifications.
• Credit monitoring — free reports weekly at annualcreditreport.com.
• Bank / card alerts — turn on all-transaction notifications via SMS/app push.
• Outbound traffic on the new device — Little Snitch / GlassWire / OpenSnitch.
• Account-activity alerts — Google, Microsoft, Apple, Discord, GitHub all support “new sign-in” alerts. Turn them on everywhere.

Network

If the compromise involved your home network, see Router Hardening. Short list:

• Change the router admin password.
• Update firmware. Replace the router if it is end-of-life.
• WPA2 or WPA3 only; disable WPS.
• Separate IoT devices onto a guest network or VLAN.
• Disable remote management and UPnP unless specifically required.
• Audit connected devices. Anything unknown — kick off, investigate.

Backups (for next time)

The single best post-incident change you can make is a working backup. Aim for the 3-2-1 rule: 3 copies of data, on 2 different media, with 1 offsite.

• Continuous + versioned: Time Machine (macOS), File History (Windows), restic / Borg / Kopia (cross-platform). Versioning matters — ransomware that encrypts files-in-place gets caught by versioning.
• Offline: an external drive disconnected when not in use. Ransomware cannot encrypt what isn’t plugged in.
• Offsite: cloud provider (Backblaze, Arq, iDrive). Encrypt before upload if you don’t trust the provider.
• Test restores: a backup you’ve never restored from is not a backup. Restore a single file each month to verify.

People

Tell your inner circle what to watch for

The attacker may pivot to the people who trust you most:

• Tell family that if they get an “I’m in trouble, send money” message from you, they should verify via a different channel — a known phone number, a family safe word, or another relative. See voice-clone scam.
• Tell coworkers to be skeptical of “urgent” requests claiming to come from you — especially payment requests, wire transfers, gift-card purchases.
• For high-risk targets (journalists, activists, clearance holders), tell sources/colleagues that any change in communication patterns warrants verification.

Mental health

Being compromised is exhausting. Guilt, anxiety, and hypervigilance are normal aftermath. Free, confidential support:

• 988 — Suicide & Crisis Lifeline, call/text.
• Crisis Text Line — text HOME to 741741.
• Military OneSource — 1-800-342-9647, 24/7 confidential counseling for servicemembers and families.
• AARP Fraud Watch — 1-877-908-3360, trained advocates for older adults and their families.
• CCRI Helpline — 1-844-878-2274, for image-based abuse victims and supporters.

Documentation

Write down:

• What was compromised.
• When.
• What you’ve done to remediate.
• What was reported, to whom, with case/ticket numbers.

You will need this for:

• Insurance claims (cyber-insurance, homeowner’s policy device riders).
• Identity-theft disputes with creditors (FTC affidavit + supporting timeline).
• Employer / security-manager reports for clearance holders (see Clearance holder IR).
• Civil action against the attacker if applicable.

See also

• Incident Response Guide — start here if you are still in the active phase of an incident
• DFP Guide — comprehensive preventive hardening
• Threats catalog — how adversaries actually operate
• MFA Guide
• Password Managers
• Router Hardening