{"id":1269,"date":"2021-10-01T13:56:54","date_gmt":"2021-10-01T13:56:54","guid":{"rendered":"https:\/\/sappan-project.eu\/?p=1269"},"modified":"2021-11-02T11:41:41","modified_gmt":"2021-11-02T11:41:41","slug":"sharing-of-incident-response-playbooks","status":"publish","type":"post","link":"https:\/\/sappan-project.eu\/?p=1269","title":{"rendered":"Sharing of incident response playbooks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
By Martin \u017d\u00e1dn\u00edk (CESNET)<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
As an incident handler, have you wondered\nwhether the way how you deal with a cybersecurity incident can be improved, how\nothers deal with the same issues, whether the handling can be automatized? If\nyes, you are not alone. There is a whole community working on a standard to express\nincident response playbooks and SAPPAN contributes to the effort.<\/span><\/b><\/p><\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<\/p>

From what I had the opportunity to observe,\nincident handling is in a majority a repetitive work. A reaction to a large\nportion of incidents is the same. I mean the reaction vary, based on the incident,\nbut similar incidents happen again and again and the reaction to a similar\nincident follows the same pattern. <\/span><\/p>\n\n

Now imagine similar incidents happen all over\nthe world constantly. Wouldn\u2019t it be great if these \u201cboring\u201d incidents were not\nhandled individually and manually? I wish there was a pool of knowledge on how\nto react to these incidents. Then the pieces of such knowledge can be shared, with\nsome customization, deployed in the infrastructure and automatically executed.<\/span><\/p>\n\n

The representation of incident handling is\nthe key enabler to sharing. Since recently, I have not come across any standard\nto represent incident handling procedures. Organizations use either high-level\nplaybooks which are human readable <\/span>(e.g. Figure 1)<\/span> but not machine readable, or\nscripts which are machine readable but not interoperable across organizations\nnor shareable and hard to understand by a human. I was simply missing a\nstandard that would fit both worlds – human readable but with a structure that\nwould allow for transforming the playbook into the instructions for a machine.<\/span><\/p>\n\n\n\n\n\n