System and method for recovering a node in a cloud infastructure after an intrusion

A system for recovering a computing device after an intrusion, the system comprising:

• a hardware processor of the computing device executing a minimalistic Operating System (OS) configured to:
• deploy a master container by:
• creating and starting the master container from a container image, providing, to the master container, access to a storage area network (SAN) volume, providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain where a configuration of the computing device is stored, and invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container;
• and
• upon receiving a notification from the IDM about an intrusion into the master container, re-deploy the master container from the container image, wherein the re-deployed master container acts as a default runtime environment on the computing device;
• wherein the re-deploying of the master container comprises:
• destroying the master container:
• creating and starting a new master container from the container image;
• and
• providing to the newly created master container a read-only access to the DCM module.

A non-transitory computer readable medium storing thereon computer executable instructions for recovering a computing device after an intrusion, including instructions for:

• by a minimalistic Operating System (OS) running on the computing device having a processor and a memory, deploying a master container by:
• creating and starting the master container from a container image,
• providing, to the master container, access to a storage area network (SAN) volume,
• providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain where a configuration of the computing device is stored, and
• invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container;
• and
• upon receiving a notification from the IDM about an intrusion into the master container, by the minimalistic OS, re-deploying, the master container from the container image, wherein the re-deployed master container acts as a default runtime environment on the computing device;
• wherein the re-deploying of the master container comprises:
• destroying the master container:
• creating and starting a new master container from the container image;
• and
• providing to the newly created master container a read-only access to the DCM module.