M4-Use-playbooks-to-respond-to-incidents.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## More about playbooks\n",
    "Previously, you learned that playbooks are tools used by cybersecurity professionals to identify and respond to security issues. In this reading, you’ll learn more about playbooks and their purpose in the field of cybersecurity. \n",
    "\n",
    "### Playbook overview\n",
    "\n",
    "A playbook is a manual that provides details about any operational action. Essentially, a playbook provides a predefined and up-to-date list of steps to perform when responding to an incident.\n",
    "\n",
    "Playbooks are accompanied by a strategy. The strategy outlines expectations of team members who are assigned a task, and some playbooks also list the individuals responsible. The outlined expectations are accompanied by a plan. The plan dictates how the specific task outlined in the playbook must be completed.\n",
    "\n",
    "Playbooks should be treated as living documents, which means that they are frequently updated by security team members to address industry changes and new threats. Playbooks are generally managed as a collaborative effort, since security team members have different levels of expertise.\n",
    "\n",
    "Updates are often made if:\n",
    "- A failure is identified, such as an oversight in the outlined policies and procedures, or in the playbook itself. \n",
    "- There is a change in industry standards, such as changes in laws or regulatory compliance.\n",
    "- The cybersecurity landscape changes due to evolving threat actor tactics and techniques.\n",
    "\n",
    "### Types of playbooks\n",
    "\n",
    "Playbooks sometimes cover specific incidents and vulnerabilities. These might include ransomware, vishing, business email compromise (BEC), and other attacks previously discussed. Incident and vulnerability response playbooks are very common, but they are not the only types of playbooks organizations develop. \n",
    "\n",
    "Each organization has a different set of playbook tools, methodologies, protocols, and procedures that they adhere to, and different individuals are involved at each step of the response process, depending on the country they are in. For example, incident notification requirements from government-imposed laws and regulations, along with compliance standards, affect the content in the playbooks. These requirements are subject to change based on where the incident originated and the type of data affected. \n",
    "\n",
    "### Incident and vulnerability response playbooks\n",
    "\n",
    "Incident and vulnerability response playbooks are commonly used by entry-level cybersecurity professionals. They are developed based on the goals outlined in an organization’s business continuity plan. A business continuity plan is an established path forward allowing a business to recover and continue to operate as normal, despite a disruption like a security breach.\n",
    "\n",
    "These two types of playbooks are similar in that they both contain predefined and up-to-date lists of steps to perform when responding to an incident. Following these steps is necessary to ensure that you, as a security professional, are adhering to legal and organizational standards and protocols. These playbooks also help minimize errors and ensure that important actions are performed within a specific timeframe.\n",
    "\n",
    "When an incident, threat, or vulnerability occurs or is identified, the level of risk to the organization depends on the potential damage to its assets. A basic formula for determining the level of risk is that risk equals the likelihood of a threat. For this reason, a sense of urgency is essential. Following the steps outlined in playbooks is also important if any forensic task is being carried out. Mishandling data can easily compromise forensic data, rendering it unusable. \n",
    "\n",
    "Common steps included in incident and vulnerability playbooks include: \n",
    "- **Preparation:** Before incidents occur, mitigate potential impacts on the organization by documenting, establishing staffing plans, and educating users.\n",
    "- **Detection and Analysis:** Detect and analyze events by implementing defined processes and appropriate technology.\n",
    "- **Containment**: Prevent further damage and reduce immediate impact of incidents.\n",
    "- **Eradication and Recovery from an incident**: Completely remove artifacts of the incident so that an organization can return to normal operations.\n",
    "\n",
    "Additional steps include performing post-incident activities, and a coordination of efforts throughout the investigation and incident and vulnerability response stages.\n",
    "- **Post-incident activity**: Document the incident, inform organizational leadership, and apply lessons learned.\n",
    "- **Coordination:** Report incidents and share information throughout the response process, based on established standards.\n",
    "\n",
    "## Key takeaways\n",
    "It is essential to refine processes and procedures outlined in a playbook. With every documented incident, cybersecurity teams need to consider what was learned from the incident and what improvements should be made to handle incidents more effectively in the future. Playbooks create structure and ensure compliance with the law. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Playbooks, SIEM tools, and SOAR tools\n",
    "\n",
    "Previously, you learned that security teams encounter threats, risks, vulnerabilities, and incidents on a regular basis and that they follow playbooks to address security-related issues. In this reading, you will learn more about playbooks, including how they are used in security information and event management (SIEM) and security orchestration, automation, and response (SOAR). \n",
    "\n",
    "### Playbooks and SIEM tools\n",
    "\n",
    "Playbooks are used by cybersecurity teams in the event of an incident. Playbooks help security teams respond to incidents by ensuring that a consistent list of actions are followed in a prescribed way, regardless of who is working on the case. Playbooks can be very detailed and may include flow charts and tables to clarify what actions to take and in which order. Playbooks are also used for recovery procedures in the event of a ransomware attack. Different types of security incidents have their own playbooks that detail who should take what action and when. \n",
    "\n",
    "Playbooks are generally used alongside SIEM tools. If, for example, unusual user behavior is flagged by a SIEM tool, a playbook provides analysts with instructions about how to address the issue. \n",
    "\n",
    "### Playbooks and SOAR tools\n",
    "\n",
    "Playbooks are also used with SOAR tools. SOAR tools are similar to SIEM tools in that they are used for threat monitoring. SOAR is a piece of software used to automate repetitive tasks generated by tools such as a SIEM or managed detection and response (MDR). For example, if a user attempts to log into their computer too many times with the wrong password, a SOAR would automatically block their account to stop a possible intrusion. Then, analysts would refer to a playbook to take steps to resolve the issue.\n",
    "\n",
    "## Key takeaways\n",
    "\n",
    "What is most important to know is that playbooks, also sometimes referred to as runbooks, provide detailed actions for security teams to take in the event of an incident. Knowing exactly who needs to do what and when can help reduce the impact of an incident and reduce the risk of damage to an organization’s critical assets. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Glossary terms from module 4\n",
    "Terms and definitions from Course 2, Module 4\n",
    "\n",
    "Incident response: An organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach\n",
    "\n",
    "Playbook: A manual that provides details about any operational action"
   ]
  }
 ],
 "metadata": {
  "language_info": {
   "name": "python"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}