Remediation – containment/recovery/mitigation
Remediation is the point in the process where you, as the incident responder, engage the threat and work to protect the organization from further harm.
We are now at the point in the process where we perform the actions necessary to respond to the threat. This is made possible through the high-quality data made available through the observe and orient tools. We have taken that data and made an appropriate decision based on our organization's mission and legal requirements. With that decision, we implement the appropriate information security tools to do the following:
- Contain the threat:
- Initially limiting damage: Ensuring that the attacker is unable, or finds it very difficult, to cause damage to other information systems.
- Fully containing threat: The reality is that as you respond to the incident you may not be able to fully contain the threat within the first few minutes of the incident. However, your goal is full containment so that you can...
