IR

Often, IR is a by-product of an organization's growth and its unique need for an IR function. Many organizations leverage IR and forensics under the same umbrella, making their coordination and cohesion imperative. Smaller organizations might even include the threat intelligence function in the IR function.

While there are many IR life cycles that can be used by an organization, we will focus on two life cycles in particular: the traditional IR life cycle popularized throughout the IR community and the second life cycle, which involves leveraging F3EAD, which is a targeting methodology employed by military special operations teams across the globe. First, let's dive in by looking at the IR life cycle.

The IR life cycle

Seemingly popularized in the NIST 800-61 Computer Incident Handling Guide (https://csrc.nist.gov/publications/detail/sp/800-61/archive/2004-01-16), the traditional IR life cycle is intended to be broad and apply to any incident type, such as phishing...