Investigating NIST and SANS incident management frameworks
As we mentioned at the beginning of this chapter, there are a few incident management frameworks that organizations follow through the incident life cycle. In this chapter, we will introduce the NIST and SANS frameworks.
The NIST framework consists of four steps, while the SANS framework consists of six steps. In the following table, we can see that both frameworks are similar and follow the same principle:
|
NIST Framework |
SANS Framework |
|
Step 1 – Preparation |
Step 1 – Preparation |
|
Step 2 – Detection and Analysis |
Step 2 – Identification |
|
Step 3 – Containment, Eradication, and Recovery |
Step 3 – Containment Step 4 – Eradication Step 5 ... |
