A blue team is a corporate security team that defends the organization against cybersecurity threats (that is, the security operation center analysts, computer security incident response teams (CSIRTs) , information security (InfoSec) teams, and others).
Security Analysts#
Security analysts are responsible for monitoring and protecting information and systems.
3 primary responsibilities
- Protecting computer and network systems
- Install prevention software
- Conducting periodic security audits
Playbooks#
A manual that provides details about any operational action. Playbooks can pertain to security or compliance reviews, access management, and many other organizational tasks that require a documented process from beginning to end.
Playbooks ensure that people follow a consistent list of actions in a prescribed way, regardless of who is working on the case.
Playbooks also clarify what tools should be used in response to a security incident.
- chain of custody playbook.
- protecting and preserving evidence playbook.
Business continuity planning#
Security teams must be prepared to minimize the impact that security incidents can have on their normal business operations. When an incident occurs, organizations might experience significant disruptions to the functionality of their systems and services. Prolonged disruption to systems and services can have serious effects, causing legal, financial, and reputational damages. Organizations can use business continuity planning so that they can remain operational during any major disruptions.
Similar to an incident response plan, a business continuity plan (BCP) is a document that outlines the procedures to sustain business operations during and after a significant disruption. A BCP helps organizations ensure that critical business functions can resume or can be quickly restored when an incident occurs.
Here are four essential steps for business continuity plans:
- Conduct a business impact analysis. The business impact analysis step focuses on the possible effects a disruption of business functions can have on an organization.
- Identify, document, and implement steps to recover critical business functions and processes. This step helps the business continuity team create actionable steps toward responding to a security event.
- Organize a business continuity team. This step brings various members of the organization together to help execute the business continuity plan, if it is needed. The members of this team are typically from the cybersecurity, IT, HR, communications, and operations departments.
- Conduct training for the business continuity team. The team considers different risk scenarios and prepares for security threats during these training exercises.
Disaster recovery plan#
A disaster recovery plan allows an organization’s security team to outline the steps needed to minimize the impact of a security incident, such as a successful ransomware attack that has stopped the manufacturing team from retrieving certain data. It also helps the security team resolve the security threat. A disaster recovery plan is typically created alongside a business continuity plan. Steps to create a disaster recovery plan should include:
- Implementing recovery strategies to restore software
- Implementing recovery strategies to restore hardware functionality
- Identifying applications and data that might be impacted after a security incident has taken place
Site resilience #
Resilience is the ability to prepare for, respond to, and recover from disruptions. Organizations can design their systems to be resilient so that they can continue delivering services despite facing disruptions. An example is site resilience, which is used to ensure the availability of networks, data centers, or other infrastructure when a disruption happens. There are three types of recovery sites used for site resilience:
- Hot sites: A fully operational facility that is a duplicate of an organization’s primary environment. Hot sites can be activated immediately when an organization’s primary site experiences failure or disruption.
- Warm sites: A facility that contains a fully updated and configured version of the hot site. Unlike hot sites, warm sites are not fully operational and available for immediate use but can quickly be made operational when a failure or disruption occurs.
- Cold sites: A backup facility equipped with some of the necessary infrastructure required to operate an organization’s site. When a disruption or failure occurs, cold sites might not be ready for immediate use and might need additional work to be operational.