2021-030-incident response, business goal alignment, showing value in IR -p2

<p><a href= "https://blog.teamascend.com/6-phases-of-incident-response"><span style="font-weight: 400;"> https://blog.teamascend.com/6-phases-of-incident-response</span></a></p> <p><a href= "https://www.securitymetrics.com/blog/6-phases-incident-response-plan"> <span style= "font-weight: 400;">https://www.securitymetrics.com/blog/6-phases-incident-response-plan</span></a></p> <p><br /> <br /></p> <p><span style="font-weight: 400;">Recent vulnerabilities got Bryan thinking about incident response. </span></p> <p><span style="font-weight: 400;">Are organizations speedy enough to keep up?</span></p> <p><span style="font-weight: 400;">If the spate of vulns continue, what can we do to ensure we are dealing with the most important issues?</span></p> <p><span style="font-weight: 400;">How do we communicate those issues to management?</span></p> <p><span style="font-weight: 400;">How should we handle the workload?</span></p> <p><span style="font-weight: 400;">Testing of your IR costs money, do you have budget for that? (verodin, red-team)</span></p> <p><span style="font-weight: 400;">Restoring backups, extra VPC or azure environment</span></p> <p> </p> <p><span style="font-weight: 400;">Incidents occur</span></p> <p><span style="font-weight: 400;">You have to minimize issues, right? But is there a good way of doing that?</span></p> <p><span style="font-weight: 400;">Simplify your environment? </span></p> <p><span style="font-weight: 400;">Spend time working on the CIS 20? You gotta plan for that and show value vs effort.</span></p> <p> </p> <p><span style="font-weight: 400;">Incident response is an ever changing landscape. </span></p> <p> </p> <p><span style="font-weight: 400;">What is the goal of IR?</span></p> <p><span style="font-weight: 400;">Minimize damage</span></p> <p><span style="font-weight: 400;">Identify affected systems</span></p> <p><span style="font-weight: 400;">Recover gracefully and quickly?</span></p> <p><span style="font-weight: 400;">Does your environment allow for quick recovery?</span></p> <p><span