NCSC Assured Building and Optimising Incident Response Playbooks

This module dives straight in with a case study on the importance of incident response playbooks. Those who are non-technical will find that attending our NCSC Assured Training in CIPR  establishes the core concepts on which this playbooks course is built.

This sections introduces the core concepts of playbooks, the types of playbooks you need and takes you through the different purposes of playbooks. 

This module further builds on Module 2 and introduces the student to key concepts of not just playbooks but the primary constituents of a good incident analyst. There is a substantial link between an analyst and playbooks and to create and use playbooks effectively you need to understand the basics.

Building on the NIST SP 800-61.r2 Computer Security Incident Handling Guide, we take the student through an in-depth understanding of the four phases of the Incident Response Lifecycle, their relationships to each other and the relationship of this concept to creating effective and fit-for-purpose incident response playbooks. 

This module introduces the importance of context in incident response and the importance of good analysis skills that help build context. This section goes through several exercises to help you understand what is context and how to use it in playbooks.

Staying with the importance of context and building on this important topic, we cover the relevance of triggers in playbooks. Put simply, a bad trigger almost always equals a terrible playbook. 

'Whom are you going to call' during an attack. Even for the most prepared there are moments when you wonder, who is it we need to call? OR who can authorise this action?  Seems simple, but there is a method and approach to getting this right and yes, you have to plan ahead.

This module breaks down the topic of automation in incident response and playbooks and dives deeper into the concepts and reasons and implementation examples of automation. This section also gives examples of how automation can be used as a force for staff retention and motivation. In addition, the student is shown a structured approach to automating actions before, during and after a cyber attack.

This module goes into significant details of how to plan and create cyber attack scenarios. 

This module covers how incident response playbooks should be tested for efficacy. This module, too, relies upon the use of relevant cyber-attack scenarios.  

A short module on the importance and role of technology in incident response playbooks. We also show you how you can create effective IR checklists without the need for specific technologies. 

Bringing all the knowledge from previous modules together, we go into detail on how to actually design and create playbooks. We use threat intelligence to create our first comprehensive playbook and examine various components of the playbook.