Eradication removes malicious artifacts and addresses the vulnerabilities or conditions exploited by the incident. Identifying the root cause enables remediation that prevents persistence or recurrence; restoration from backups belongs to recovery, while notification is a communications activity. NIST SP 800-61 Rev. 2 states that eradication includes eliminating incident components and identifying and mitigating exploited vulnerabilities.
Community Discussion