Incident response plants are incredibly important for both IT and OT cybersecurity. They guide you in stressful crises, and aid in both tactical procedures and decision making.
I cannot state enough how important it is that your organization has plans for every environment, those plans are tested, and that ultimately you write and edit the bulk of those plans yourself.
There are skeevy consulting companies who will sell you almost anything - from premade IR plans to services that build them for you without your involvement. However, I can absolutely guarantee without serious project-scale care and feeding from your own stakeholder personnel and environmental considerations, they will fall flat in an emergency. You wouldn’t want your hospital to download a premade triage plan for another size or functional org from scribd.
Can’t stress enough how important it is to take the time to plan, even if you bring in consultants to guide and advise you.
#cybersecurity #dfir
@hacks4pancakes@infosec.exchange Indeed. The best ‘premade plan’ isn’t worth a few hours of the right people sitting around a table discussing ‘what if…’
I’ll go further than that.
The best ‘premade plan’ (that no one has read) is not going to be as useful as having had the right people sitting around a table for a few hours drinking and talking shit and exchanging contact details and getting to know each other.