Most large organizations have a security incident response (IR) program in place – even if it only exists in a three-ring binder. The challenge for most is to get from its current form into an automated platform that will empower you to respond better, faster and with precision.
For starters, find a security incident response platform (SIRP) that empowers you to create and evolve your program. There is a difference between applications and point solutions versus a platform. A true platform is something you can build upon and manipulate to do things not originally envisioned. It’s very common for requirements to change when developing a program as complex as security incident response. Be sure you’re not boxed into to a rigid system. Other recommendations include:
