Evaluating a security operations strategy for the incident management life cycle
The life cycle of managing an incident response can be viewed as a tiered approach. The more prepared security operations are for identifying and responding to threats, the lower the impact on the business from a financial, personal, and reputational perspective.
Figure 3.13 shows the tiers of the various security operations functions:
Figure 3.13 – Security operations functional tiers
As shown in Figure 3.13, automation in the workflow is important to managing the efficiency of a security operations team. The more automated responses that can be put in place for well-known attacks, such as phishing-based URLs, SQL injection attacks, brute-force identity attacks, or port scans, can use solutions. An example would be a Web Application Firewall (WAF), which protects against SQL injections, or Microsoft Defender for Office 365, which protects against phishing. Another...
