Crafting the InfoSec Playbook

Chapter 6. Operationalize!

“Everybody has a plan until they get punched in the face.”

Mike Tyson

Everything up to this point, the ideas and questions in the first five chapters, has served to prepare you to create a playbook you can deploy. Your playbook should reflect that you’ve asked relevant questions and built a plan and plays that are as unique as your organization and its assets. Your playbook should reflect that you identified what threats to look for, what assets and information you intend to protect, how to lay out the architecture, how to prepare the data, and how to get the logs flowing. That plan is now ready for operationalization! This chapter will explain, by way of example, how to put your plan into action, how to avoid operational problems, and how to keep it running smoothly.

To really make it work, we’ll discuss some key questions throughout the chapter to ready your playbook for real-world security operations. These questions are core to keeping the playbook a living thing:

• How can I determine the amount of resources needed to analyze the entire playbook?

• What systems will I need in place to make my plan work?

• How can I manage a living playbook?

• How can I avoid operational problems?

• How can I make reporting and alerting more efficient?

Simply having a playbook and detection logic is not enough. Your plays must actually run to generate results, those results must be analyzed, and remedial actions must be taken for malicious events. Operationalizing ...