Remediation is the point in the process where you, as the incident responder, engage the threat and work to protect the organization from further harm.
We are now at the point in the process where we perform the actions necessary to respond to the threat. This is made possible through the high-quality data made available through the observe and orient tools. We have taken that data and made an appropriate decision based on our organization's mission and legal requirements. With that decision, we implement the appropriate information security tools to do the following:
- Contain the threat:
- Initially limiting damage: Ensuring that the attacker is unable, or finds it very difficult, to cause damage to other information systems.
- Fully containing threat: The reality is that as you respond to the incident you may not be able to fully contain the threat within the first few minutes of the incident. However, your goal is full containment so that you can begin the process of eradication.
- Eradicate the threat:
- During this phase of remediation, we are concerned with the complete removal of the threat from our information systems.
- Care must be taken to fully understand the threat, ensuring that it is fully removed from the information system. Not doing this could result in the attacker still maintaining a foothold in your information system, resulting in a future outbreak based on an improperly remediated incident.
- Recover from the threat:
- Part of the incident response process must account for restoring the information system back to its fully operational capability
- The incident response team must test to ensure the following:
- That the information system is operating as expected and the business processing capability has resumed
- That the threat has been completely neutralized and there are no indications that the threat has resurfaced