Summary
This chapter focused on all the preparation necessary to resolve incidents. As you must have understood by now, there is a lot to think about when it comes to incident resolution. Some of the policies required for security teams were discussed, as well as the corresponding foundational security concepts. This chapter also discussed privileged account management, approaches to logging and monitoring, endpoint protection, and device forensics.
These areas are continually evolving as new technologies and approaches are introduced into the technology landscape, and managers of security programs need to consider the impact of new technologies in light of the requirements also discussed in this chapter.
In the next chapter, we will focus on security operations itself—that is, how security teams put all the things we have discussed in this chapter into practice.
