Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are:
I can't understand the difference between Investigation phase and Analysis and Tracking phase. Both refer to analyzing and dissecting the collected evidence in-house or with external experts.
Any help?
Regards.
The short version is that investigation is gathering information, and analysis is putting information (gathered from the investigation) into a comprehensive picture.
The ECcouncil (CEH governing body) says
Computer hacking forensic investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks.
After this information is obtained, an analysis can be made about the information. An analysis might include the risk of a repeat attack, what information was taken, other vulnerable systems that might also be exploited, what was the attacker searching for, etc.
