Grand List of Incident Management Frameworks

Forming a Computer Security Incident Response Team (CSIRT) is a complicated affair. It involves a certain combination of staff, processes and technologies.

Luckily, numerous incident management frameworks are available for the rescue. They all aim to provide a structured approach for establishing incident response teams in your organisation.

This post provides a general overview of the most popular incident management frameworks.

Read More

Should SOCs monitor application or infrastructure logs for suspicious events?

We learned from the previous article that SOCs/Incident Response teams should be looking for threats that represent high-level risks to the normal business activities.

We know the who, but how can we define what needs to be protected?

Assume your company has over a thousand business applications. They are hosted in multiple data centres as well as in the cloud. There are Windows and Linux hosts, and many of these are not patched of course. On top of that, nobody knows who owns them.

The following article cuts through this complexity and explains a simple approach.

Read More