Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned
The more common type might be an incidence response playbook. This is a guide that helps security professionals mitigate issues with a heightened sense of urgency, while maintaining accuracy. First, you would need to validate whether the alert is actually valid. Next, the playbook would outline the actions and tools used to contain the malware and reduce further damage (for example, isolating or disconnecting infected network systems). After containing the incidence, step three would involve eliminating all traces of the incident and restore the system back to normal functionality. Lastly the playbook would inform to perform various post-incident activities and coordination efforts with the security team and also sometimes report incidents to the appropriate authorities
Incident and vulnerability response playbooks are only two examples of the many playbooks that an organization uses. If you plan to work as a cybersecurity professional outside of the U.S., you may want to explore the following resources: