Security Operations
This chapter will focus on the actual mechanics of security operations, how to manage cybersecurity incidents, and the steps involved in incident resolution.
The chapter will start with key aspects of managing security incidents and take you through the incident response cycle, focusing on detection, response, mitigation, eradication, and recovery. You will also examine how to conduct a “no blame” lessons learned review and some points on reporting and communication.
You will then learn how to operate and maintain common security defenses and review the practicalities of vulnerability management and change management approaches. While the previous chapter focused on the policy and planning side of things, this chapter focuses more on the practical implementation of all the techniques in day-to-day operations.
By the end of this chapter, you will be able to answer questions on the following:
- Conducting incident management
- Operating...
