cacao — archive

[Bret Jordan <f.h.schippers@hva.nl>]

Frans, Are you looking for examples of what exists in the SoC today?  If you search for "security playbooks on Google the first 2 or 3 non sponsored links have some visual examples.  In slide ware, when I talk about this, I often give the follow examples as it is something that most people can easily understand: Security Operations Center Open ticket with priority level 2 Call level one network support If they do not respond within 10 minutes Escalate to level 2, then level 3, then management Network Support Quarantine system to sandbox VLAN Security Operations Center Call level level one desktop support If they do not respond within 30 minutes Escalate to level 2, then level 3, then management Desktop Support Delete run at start reg keys and triggers Reboot into SafeMode Kill process sysmg.exe then winsrvx.exe then xnc.exe Delete temp files Delete compromised files defined in KB article 311 Delete other registry keys defined in KB article 312 Reboot system in to safe mode Verify processes do not restart after cleanup If this does not work, escalate Patch AV system and run updated AV scan Patch OS Run additional on-demand special AV scanners Reboot system to normal mode Update ticket Network Support Monitor traffic from system for 90 minutes If no abnormal behavior is detected move system out of sandbox VLAN in to a restricted watch VLAN for 24 hours If no user issues or abnormal behavior is detected move system to production VLAN Update and close ticket Bret On Sep 26, 2019, at 1:34 AM, Frans Schippers < f.h.schippers@hva.nl > wrote: Dear members Can anyone share some playbooks with me? Frans Schippers Cyber Security Lecturer / Researcher Amsterdam Universe of Applied Science HBO-ICT Wibautstraat 2-4 1091 GM Amsterdam PGP: 12D1 D930 488C 22B7 6AFF  BFF7 218C 865E D6E0 6B48