Information Security Handbook

Identification – detection and analysis

Now that we have gone through the process of preparation, we are now prepared to discuss the activities around detection and analysis.

A key concept that you must understand and develop as a core component of your incident response capability is the concept of incident triage. The reality is that not all incidents are treated the same, and by using a triage approach you are able to focus on the events that are important while ignoring the noise.

The following list provides a sample of the potential attack vectors that can be used by an attacker that the incident responder will need to be prepared to respond to. Each one of the following categories is very different in how it can be exploited, and therefore ...