The goal of the preparation stage is to ensure that the organization can comprehensively respond to an incident at a moment’s notice. In a SANS incident response pl… See more

This step involves detecting deviations from normal operations in the organization, understanding if a deviation represents a security incident, and determining how important t… See more

The goal of containment is to limit damage from the current security incident and prevent any further damage. Several steps are necessary to completely mitigate the incident, w… See more

Eradication is intended to actually remove malware or other artifacts introduced by the attacks, and fully restore all affected systems. The SANS eradication process involves: 1. … See more

The goal of recovery is to bring all systems back to full operation, after verifying they are clean and the threat is removed. The SANS recovery procedure involves: 1. Defining ti… See more