Using templates and playbooks

There are several IR templates and playbooks for several types of security events that can be found online from reputable sources. For instance, the website www.incidentresponse.com provides IR playbooks for malware outbreaks, phishing, data theft, virus outbreaks, unauthorized access, elevation of privilege, and root access security events. Each of the playbooks is broken down into the phases that an IR team has to use to fully recover from a particular security incident. Such playbooks are helpful as they can guide security teams to respond quickly to an incident without having to start from scratch.

Playbooks and templates should be customized to fit an organization's needs and resources. Some of these documents are authored for certain scenarios that might be non-existent in conventional organizations. Therefore, firms should look at how the templates they plan to use can be made to fit with their resources and requirements. However, they...