What is the meaning of Triage in Cybersec world?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in the SOC (Security Operations Center) that I am currently working.
terminology soc
edited 2 days ago
schroeder♦
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
add a comment |
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in the SOC (Security Operations Center) that I am currently working.
terminology soc
edited 2 days ago
schroeder♦
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
7
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
3
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
2
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday
add a comment |
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in the SOC (Security Operations Center) that I am currently working.
terminology soc
edited 2 days ago
schroeder♦
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in the SOC (Security Operations Center) that I am currently working.
terminology soc
terminology soc
edited 2 days ago
schroeder♦
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
edited 2 days ago
schroeder♦
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
edited 2 days ago
schroeder♦
78.8k30175211
edited 2 days ago
schroeder♦
78.8k30175211
edited 2 days ago
schroeder♦
78.8k30175211
78.8k30175211
asked 2 days ago
victor26567victor26567
31134
asked 2 days ago
victor26567victor26567
31134
asked 2 days ago
victor26567victor26567
31134
31134
7
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
3
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
2
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday
add a comment |
7
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
3
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
2
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday
7
7
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
3
3
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
2
2
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday
add a comment |
3 Answers
3
active
oldest
votes
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to sit there and be useless for a while.'
It comes from the medical world, as you've stated. It's the same reasoning as an ER doctor looking at two patients and deciding to work on the one that they're more certain they can save. You let one go, as hard as it may be, so that the other might live. If you'd worked on the worse injured person, it's possible they both would have died.
The difference in the security world is that often it's dollars lost due to users being unable to work, rather than literal life and death. You work on the systems that you are most likely to be able to restore, and that will return the largest amount of productivity to the environment. You leave the individual laptops that only affect a single user to the side, for now.
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
|
show 4 more comments
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the garbage packets. A report of suspicion may get placed in a queue for a generalist to handle later. Evidence of an intrusion may get escalated immediately to the Incident Management team.
edited yesterday
yoozer8
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
add a comment |
In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it.
Triage
The process of validating a vulnerability submission from raw submission to a valid, easily digestible report.
Source: https://www.bugcrowd.com/resources/glossary/triage/
Or when talking about various states of a reported bug:
Triaged: A submission that may be valid, but needs to be reviewed again and validated.
Source: https://docs.bugcrowd.com/docs/submission-status
The term is used in similar context by HackerOne as well (though they have less states for a submission so this covers more than the same-name state by BugCrowd):
Triaged - The report is evaluated but hasn't been resolved. It is in the state of being fixed.
Source: https://docs.hackerone.com/hackers/report-states.html
answered yesterday
Torin42Torin42
1362
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f207100%2fwhat-is-the-meaning-of-triage-in-cybersec-world%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to sit there and be useless for a while.'
It comes from the medical world, as you've stated. It's the same reasoning as an ER doctor looking at two patients and deciding to work on the one that they're more certain they can save. You let one go, as hard as it may be, so that the other might live. If you'd worked on the worse injured person, it's possible they both would have died.
The difference in the security world is that often it's dollars lost due to users being unable to work, rather than literal life and death. You work on the systems that you are most likely to be able to restore, and that will return the largest amount of productivity to the environment. You leave the individual laptops that only affect a single user to the side, for now.
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
|
show 4 more comments
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to sit there and be useless for a while.'
It comes from the medical world, as you've stated. It's the same reasoning as an ER doctor looking at two patients and deciding to work on the one that they're more certain they can save. You let one go, as hard as it may be, so that the other might live. If you'd worked on the worse injured person, it's possible they both would have died.
The difference in the security world is that often it's dollars lost due to users being unable to work, rather than literal life and death. You work on the systems that you are most likely to be able to restore, and that will return the largest amount of productivity to the environment. You leave the individual laptops that only affect a single user to the side, for now.
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
|
show 4 more comments
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to sit there and be useless for a while.'
It comes from the medical world, as you've stated. It's the same reasoning as an ER doctor looking at two patients and deciding to work on the one that they're more certain they can save. You let one go, as hard as it may be, so that the other might live. If you'd worked on the worse injured person, it's possible they both would have died.
The difference in the security world is that often it's dollars lost due to users being unable to work, rather than literal life and death. You work on the systems that you are most likely to be able to restore, and that will return the largest amount of productivity to the environment. You leave the individual laptops that only affect a single user to the side, for now.
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
We just got reports that 4000 of our systems are infected with ransomeware.
3000 are end users, 800 are non-critical servers, 200 are critical servers.
Triage is looking at this mess and deciding which order to start restoring systems in. We can't tackle them all at once, so we have to look at some and say 'Sorry, little Inspiron that couldn't, you get to sit there and be useless for a while.'
It comes from the medical world, as you've stated. It's the same reasoning as an ER doctor looking at two patients and deciding to work on the one that they're more certain they can save. You let one go, as hard as it may be, so that the other might live. If you'd worked on the worse injured person, it's possible they both would have died.
The difference in the security world is that often it's dollars lost due to users being unable to work, rather than literal life and death. You work on the systems that you are most likely to be able to restore, and that will return the largest amount of productivity to the environment. You leave the individual laptops that only affect a single user to the side, for now.
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
answered 2 days ago
AdonalsiumAdonalsium
3,87611121
3,87611121
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
|
show 4 more comments
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
2
2
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
wow, thanks a lot. So, in brief, it is like prioritize which systems you want to restore, because there are many of them, and you cant work with all of them at the same time, right?
– victor26567
2 days ago
31
31
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
Poor lil' Inspiron :(
– Kyle Vassella
2 days ago
5
5
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
In the modern medical world I think there is very little "letting one go so the other might live" - it's more about making the person with a broken leg wait (they probably won't die in the meantime) while they fix the unconscious person who's been knifed (who probably will).
– Martin Bonner
yesterday
8
8
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
@MartinBonner Then assume by 'doctor' I meant 'battlefield medic'. :)
– Adonalsium
yesterday
4
4
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
@MartinBonner it depends of the context, usually there is time to provide some assistance to everyone and it is just a matter of avoiding that you do not fail to provide care to the urgent cases because you are dealing with the non-urgent ones (you just will not get 400 hearts attacks at the same time at an hospital). But if there are suddenly lots of critical cases (for example, after an earthquake or other disaster) then the part about deciding who is too injured to survive (and hence a drain of much needed resources) may kick in.
– SJuan76
yesterday
|
show 4 more comments
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the garbage packets. A report of suspicion may get placed in a queue for a generalist to handle later. Evidence of an intrusion may get escalated immediately to the Incident Management team.
edited yesterday
yoozer8
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
add a comment |
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the garbage packets. A report of suspicion may get placed in a queue for a generalist to handle later. Evidence of an intrusion may get escalated immediately to the Incident Management team.
edited yesterday
yoozer8
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
add a comment |
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the garbage packets. A report of suspicion may get placed in a queue for a generalist to handle later. Evidence of an intrusion may get escalated immediately to the Incident Management team.
edited yesterday
yoozer8
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
In addition to Adonalsium's fine answer regarding prioritization, the triage step will include the initial routing of the event to the people best suited to handle it.
A virus or ransomware attack would go to the operations team who would first isolate the computer to minimize collateral damage. A DDoS attack may go to the network team to start sinking the garbage packets. A report of suspicion may get placed in a queue for a generalist to handle later. Evidence of an intrusion may get escalated immediately to the Incident Management team.
edited yesterday
yoozer8
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
edited yesterday
yoozer8
1741211
edited yesterday
yoozer8
1741211
edited yesterday
yoozer8
1741211
1741211
answered 2 days ago
John DetersJohn Deters
29.1k34393
answered 2 days ago
John DetersJohn Deters
29.1k34393
answered 2 days ago
John DetersJohn Deters
29.1k34393
29.1k34393
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
add a comment |
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
Worth noting that this can also be an ongoing process. Alerts are always numerous, so an initial sift, sort, and send is typically conducted by one person, while the rest of the team deep dives into the issues raised.
– Jozef Woods
yesterday
add a comment |
In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it.
Triage
The process of validating a vulnerability submission from raw submission to a valid, easily digestible report.
Source: https://www.bugcrowd.com/resources/glossary/triage/
Or when talking about various states of a reported bug:
Triaged: A submission that may be valid, but needs to be reviewed again and validated.
Source: https://docs.bugcrowd.com/docs/submission-status
The term is used in similar context by HackerOne as well (though they have less states for a submission so this covers more than the same-name state by BugCrowd):
Triaged - The report is evaluated but hasn't been resolved. It is in the state of being fixed.
Source: https://docs.hackerone.com/hackers/report-states.html
answered yesterday
Torin42Torin42
1362
add a comment |
In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it.
Triage
The process of validating a vulnerability submission from raw submission to a valid, easily digestible report.
Source: https://www.bugcrowd.com/resources/glossary/triage/
Or when talking about various states of a reported bug:
Triaged: A submission that may be valid, but needs to be reviewed again and validated.
Source: https://docs.bugcrowd.com/docs/submission-status
The term is used in similar context by HackerOne as well (though they have less states for a submission so this covers more than the same-name state by BugCrowd):
Triaged - The report is evaluated but hasn't been resolved. It is in the state of being fixed.
Source: https://docs.hackerone.com/hackers/report-states.html
answered yesterday
Torin42Torin42
1362
add a comment |
In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it.
Triage
The process of validating a vulnerability submission from raw submission to a valid, easily digestible report.
Source: https://www.bugcrowd.com/resources/glossary/triage/
Or when talking about various states of a reported bug:
Triaged: A submission that may be valid, but needs to be reviewed again and validated.
Source: https://docs.bugcrowd.com/docs/submission-status
The term is used in similar context by HackerOne as well (though they have less states for a submission so this covers more than the same-name state by BugCrowd):
Triaged - The report is evaluated but hasn't been resolved. It is in the state of being fixed.
Source: https://docs.hackerone.com/hackers/report-states.html
answered yesterday
Torin42Torin42
1362
In addition to the other great answers, the term triage is also used in the bugbounty bug report process to mean the process of initially reproducing the issue and assigning a priority to it.
Triage
The process of validating a vulnerability submission from raw submission to a valid, easily digestible report.
Source: https://www.bugcrowd.com/resources/glossary/triage/
Or when talking about various states of a reported bug:
Triaged: A submission that may be valid, but needs to be reviewed again and validated.
Source: https://docs.bugcrowd.com/docs/submission-status
The term is used in similar context by HackerOne as well (though they have less states for a submission so this covers more than the same-name state by BugCrowd):
Triaged - The report is evaluated but hasn't been resolved. It is in the state of being fixed.
Source: https://docs.hackerone.com/hackers/report-states.html
answered yesterday
Torin42Torin42
1362
answered yesterday
Torin42Torin42
1362
answered yesterday
Torin42Torin42
1362
answered yesterday
Torin42Torin42
1362
1362
add a comment |
add a comment |
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f207100%2fwhat-is-the-meaning-of-triage-in-cybersec-world%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
7
It means the same thing, just applied to tech/business issues rather than medical issues.
– Matthew Read
2 days ago
3
Not related to cybersec, but the term "triage" can also be used in software development: if a user reports a bug by opening a ticket in the bug tracker, someone must check whether it can be reproduced, what team it should be assigned to, and its severity or priority (that is, how disruptive it is and how urgent it is to fix: is it critical, normal, negligible...?). Some call this process triage. For example, Google uses this term in the Chromium project.
– Fabio Turati
2 days ago
2
Just to add the definition: the assignment of degrees of urgency to wounds or illnesses to decide the order of treatment of a large number of patients or casualties. Now replace wound with a computer word and replace patient with server/workstation.
– JPhi1618
2 days ago
There was an Arabic website for hackers called something like "TrYaG AlArab" but it is shut down about 9 years ago, your question just reminded me with this website. This same word exists in the Arabic language also but it comes with the meaning "medicine"
– AccountantM
yesterday