Summary
In this chapter, you explored the nitty-gritty of security operations and what an actual implementation looks like. The chapter discussed the management of cybersecurity incidents and some of the settings for operating and maintaining an operational security practice. How this works in practice depends, in many ways, on the nature of the organization, its culture, and how it generally manages its IT environment when it comes to monitoring, incidents, and changes.
Security teams need to work with the rest of the organization to ensure that their practices align with what is already established practice in an organization but also ensure that in doing so they can and will maintain an acceptable security baseline. That is a difficult undertaking.
Despite all the best efforts of the security and IT team, disasters, in the form of system compromise or natural disasters, sometimes do occur. That is the topic of the next chapter.
