Make sure there’s an incident response plan for your workload. Use industry frameworks that define the standard operating procedure for preparedness, detection, containment, mitigation, and post-incident activity.
During a crisis, avoid confusion by having a clear security incident response plan. Responsible roles can focus on execution without wasting time on uncertain actions. A comprehensive plan helps you meet remediation requirements.
Contoso’s challenge
- The workload team is setting up retailer support channels, customer support channels, and technical on-call rotations for support escalations and outages.
- They haven’t addressed security specifically and don’t know what Contoso offers for support.
Applying the approach and outcomes
- The workload team works with the Contoso security team to understand compliance requirements for handling personal data from both an organization perspective and external compliance perspective.
- The team builds a security detection, mitigation, and escalation plan, including communication for incidents.
- The team now feels just as comfortable with security incident preparedness as they do with their reliability support. They plan to practice handling incidents before they go live.
Codify secure operations and development practices
Set clear team-level security standards for your workload’s life cycle and operations, including how to write code, approve changes, release updates, and handle data.
Having robust security habits helps avoid mistakes and keeps things running smoothly. When everyone follows the same approach, it’s easier to stay on track and work efficiently.
Over time, sticking to these standards helps you spot ways to improve and maybe even automate steps to save time and boost consistency.
Contoso’s challenge
- After getting ready to handle incidents, the team realized they need to invest in preventing problems before they happen.
- They don’t have a specific secure development process yet. They plan to reuse processes that they used on past projects.
Applying the approach and outcomes
- This workload doesn’t store highly sensitive data like credit card information, but the team still treats their customers’ data with care. They’re aware of local and federal regulations that must be followed for the types of data that they store.
- The team invests in learning about current industry-standard secure development and operations practices and starts using measures that they hadn’t used before.
- The team also shares their learnings with the Contoso security team so that everyone across the company can benefit from the improvements.
Leave a Reply