| The terms I have heard in the past are:
1. Mitigate - This is a tune to a temporary fix through a compensating control.
2. Containment - This act can prevent the spread of the malware or stop it from progressing. Some use mitigate and containment interchangeably, others view them as very different things.
3. Remediate - This is the real / permanent fix. For example, removal of the malware from the machine. For mitigation would be just preventing the malware from spreading by denying it at the firewall or proxy
4. Prevent - This is kind of a proactive step
5. Investigate - The course of action is to investigate this thing.
I know the OpenC2 has a series of Actions that they have assigned to a lot of different things.. It will be really interesting to see their proposal.
Thanks,
Bret Bret Jordan CISSPDirector of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
Hi John – Re: “Should we add “remediate” in as a distinct option from “mitigate”? Is the difference between those two terms well-understood, clean, and relevant for cyber threat intelligence sharing?” I would say that remediate and mitigate are different terms and often are confused as the same thing when they are *not* the same thing. Therefore, we should not use mitigate to mean both. If the COA proposal has capability to do both then we should make it clear by using both terms. And therefore avoid ambiguity around these terms. allan
|