1

I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are:

  1. Response
  2. Triage
  3. Investigation
  4. Containment
  5. Analysis and tracking
  6. Recovery
  7. Repair
  8. Debriefing and feedback

I can't understand the difference between Investigation phase and Analysis and Tracking phase. Both refer to analyzing and dissecting the collected evidence in-house or with external experts.

Any help?

Regards.

0

The short version is that investigation is gathering information, and analysis is putting information (gathered from the investigation) into a comprehensive picture.

The ECcouncil (CEH governing body) says

Computer hacking forensic investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks.

After this information is obtained, an analysis can be made about the information. An analysis might include the risk of a repeat attack, what information was taken, other vulnerable systems that might also be exploited, what was the attacker searching for, etc.

| improve this answer | |
  • New account. Not enough reputation :( – Alien Light May 31 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.