Information Security Handbook

Remediation – containment/eradication/recovery

Here is where we come to the true purpose of establishing a security operations center—containment, eradication, and recovery from external and internal threats to your organization. Being able to respond to a threat rapidly will spell the difference between an easily contained versus a highly damaging incident.

Your remediation strategy is also very much tied to your business's mission, and the steps that you take to remediate a threat can be very different from one organization to another.

Regardless of your organization's business strategy, your SOC team must ensure that they effectively:

• Contain the threat: Ensuring that the attacker is unable to or finds it very difficult to cause damage ...