DFIR
Technology & Computing abbreviation · Cybersecurity
| Stands for | Digital forensics and incident response |
|---|---|
| Categories | Technology & Computing |
DFIR stands for Digital forensics and incident response, a cybersecurity abbreviation.
The combined discipline of investigating security incidents: collecting and analyzing evidence from disks, memory, logs and networks to establish what happened, then containing and recovering from the attack.
Example: The DFIR team imaged the server's memory before anyone rebooted it.
Usage notes
Forensic work follows chain-of-custody practices so evidence can hold up in court or insurance claims. Common tools include Volatility for memory analysis, Velociraptor and Autopsy. Consulting firms such as Mandiant are best known for this work after major breaches.
Related abbreviations
More cybersecurity abbreviations
- CWE – Common Weakness Enumeration
- DAC – Discretionary access control
- DAST – Dynamic application security testing
- DDoS – Distributed denial of service
- DES – Data Encryption Standard
- DevSecOps – Development, security and operations
- DH – Diffie-Hellman (key exchange)
- DKIM – DomainKeys Identified Mail
- DLP – Data loss prevention
- DMARC – Domain-based Message Authentication, Reporting and Conformance
- DoS – Denial of service
- DPI – Deep packet inspection