![\"\"](\"https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2023\/07\/image-1024x509.png\")
<\/figure>\n\n\n\nPreparation <\/h4>\n\n\n\n
In preparation phase, you prepare the people, process and technology to successfully respond to cyber security incidents. You will identify the people needs to be on-call, hands on keyboard and take actions. Create playbooks and runbooks for the each scenario. And designing emergency or break-glass access to the environment.<\/p>\n\n\n\n
Playbooks \/ Runbooks is a documented set of procedures and automation to address specific scenario. For e.g. Playbook for ransomware, bit coin mining and DDOS attacks<\/p>\n\n\n\n
Operations<\/h4>\n\n\n\n
Operations phase encompasses Detection & Analysis, Containment, Eradication & Recovery phases. In this phase, you act on active security incident meaning you detected security event on your favourite SIEM tool and determining whether the security incident is false or true positive. If its Security incident response is not an one-time activity and goal is to learn from the past incidents and improve your preparations and operations phase if you find gaps. For example, if you identified some steps are missing to resolve the security incident then update the playbook with necessary steps.<\/p>\n\n\n\n Regularly conduct security game day, red team exercise and threat simulation activity to test your playbooks, run books, people and process.<\/p>\n\n\n\n There is a difference between seeing an alert and not seeing an alert. In order to successfully respond to security event then you or your team have mechanism to see an alert. So first step is to turn ON logging for all resources whether its cloud or on-premise or container or serverless workloads. Next step is to aggregate logs into central repository to run detection logic and also helpful to investigate actual security incident. <\/p>\n\n\n\ntrue positive<\/code> then executing series of steps as pre-defined playbook to address the incident. And also in this phase you have to contain the incident as quickly and eradicate \/ restore the system to good working condition.<\/p>\n\n\n\nPost incident activity<\/h4>\n\n\n\n
Conclusion<\/h4>\n\n\n\n