SANS Incident Handler's Handbook and PICERL Methodology
Phase 4: Eradication – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology E-2: Improve defences so the same cause cannot recur: patch exploited weaknesses, disable unused services, harden

What does E-2 require?

Having learned what caused the incident, the team improves defences before return to service, for example installing patches for the exploited vulnerabilities, disabling unused services and hardening the rebuilt systems; the checklist asks why if a system cannot be reimaged and hardened or artefacts cannot all be removed.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 4: Eradication – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls