The first few hours
When a real security incident is detected, the first few hours decide almost everything. And they are the worst time to improvise: there is pressure, incomplete information and many people asking at once. Without a playbook, time is lost on the basics: who coordinates, who gets told, what can be switched off, who talks to customers.
The phases of the playbook
A response playbook follows recognisable phases:
- Detect and classify: is this a real incident?, how severe is it? Severity decides who gets told and how urgently.
- Contain: limit the damage. Isolate a system, disable a credential, block an access route. These decisions are authorised in advance in the playbook, so that nobody is waiting on approvals mid-incident.
- Investigate: what happened, since when, how far it reached. This is where you find out whether the logs existed and were protected.
- Eradicate: remove the cause: the attacker's access, the vulnerability, the weak configuration. Rotate everything that may have been compromised.
- Recover: return to normal service safely, with the procedures from designing for failure.
- Learn: blameless analysis and permanent actions.
Written roles
The playbook says who coordinates (one single person decides), who investigates, who communicates (internally and externally) and who decides whatever the playbook does not foresee. It also says who has to be notified outside and within what period: affected customers, suppliers and, where regulation requires it, the authorities.
Rehearsing
A playbook that has never been rehearsed has the same problems as a backup that has never been restored. Rehearsals can be simple: a two-hour session in which a scenario is put forward ('an administration credential turns up in a public repository') and the team walks the playbook step by step. Every rehearsal finds something to fix, and that is exactly the point.
One last idea remains, the one that ties the whole series together: that security should not feel like a brake.
How we apply it: Cybersecurity.