Responding to Incidents

Detecting incidents is one thing, but being able to respond to them in a timely manner is even more important. Assume that you have put in place the necessary mechanisms to detect and prioritize incidents. What is next?

Next, you want the ability to remediate these incidents. There can be, however, several types of incidents: first, in terms of severity—from minor to major or critical incidents—second, in terms of complexity—from easy-to-fix with a single problem to address to more complex ones caused by multiple intertwined issues. From a priority perspective, you want to address the most critical issues first. How can you tackle all incidents in a timely manner? The solution is a combination of automation—for straightforward issues—and prescriptive guidance.

First, automation is a must-have. It might not look necessary from the perspective of a single solution managed by a single team, but if you consider a security...