Remediation – containment/recovery/mitigation
Remediation is where you, as the incident responder, actively engage with the threat to protect the organization from further harm. This phase is possible due to the observation and orientation tools’ high-quality data. After analyzing the data and making an appropriate decision based on the organization’s mission and legal requirements, you can implement the necessary information security measures to address the threat.
The remediation phase can be broken down into three main actions:
- Contain the threat:
- Initially limiting damage: The primary objective at this stage is to ensure that the attacker is unable or finds it highly challenging to cause harm to other information systems. This could involve isolating affected systems, implementing temporary access controls, or blocking specific IP addresses or domains.
- Fully containing the threat: In reality, you may not be able to fully contain the threat within the...
