Data Breach Planning & Response: Playbooks Session

• The basic building blocks of a good and effective playbook.
• How NOT to respond to incidents, attacks and data breaches; pitfalls to avoid when creating playbooks.
• Triage - What it is and what's its role in incident management.
• How to use playbooks to aid in Triage.
• Definition of a breach - Why you need this and how to roll this out in your organisation.
• Creating Scenarios - Deep-dive into creating effective scenarios.
• Creating playbooks - Starting from basic to complex playbooks - Multiple interactive sessions.
• Management playbooks - How to build and engage management to use playbooks.
• Running internal workshops - How to ensure maximum participation and effective results.
• Understanding the technology stack required to deliver automation.
• Understanding the role of SOAR (Security Orchestration and Response) and the tools that you can use.
• Organisational capability and the role of playbooks in increasing staff skills and retention.

• Applicable knowledge to create and use actionable playbooks.
• Useful templates and collateral that you can deploy in your organisation.
• Understanding SOAR, other technologies and automation to help in the "heavy lifting" of manual tasks.
• Avoid the common pitfalls of incident response plans and playbooks.

Learning Objectives:

• List key benefits of playbooks and recognise their significance in enabling an organisation’s cyber resilience.
• Understand the basics of creating playbooks and describe the key components required to create them.
• Communication strategies during a data breach.
• Create organisation-specific attack scenarios.
• Analyse and assess the scenario and select the appropriate playbook.
• Construct simple and complex playbooks.

Target audience:

• IT Technicians
• Level 1, level 2, IT support
• Network engineers
• Windows, Unix and Max engineers
• SOC Analysts (all levels)
• IT Managers, Network Managers
• Change Managers
• Service Managers
• BCP Managers
• CISOs / Heads of IT security
• Risk Managers
• Heads of IT
  
  

Meet the Trainer 

Amar Singh has a long history and experience in data privacy and information security. Amar has served as CISO for various companies, including News International (now News UK), SABMiller, Gala Coral, Euromoney and Elsevier. Amongst various other activities, Amar is a Global Chief Information Security Officer and Trusted Advisor to a number of organisations including a FTSE100 firm, and is chair of the ISACA UK Security Advisory Group. He also founded the not-for-profit cybersecurity service for charities, Give01Day.

Amar has the highest integrity and is trusted by FTSE100 companies with some of the most sensitive commercial information. He has been involved with highly sensitive forensic investigations.

He has the ability to deal with both technically-astute, board-level executives and lead an organisation's information security direction. Apart from his experience and abilities, Amar holds a number of industry-recognised certifications, such as ISO 27001 Certified ISMS Lead Implementer, MoR, CRISC and CISSP certification.

Amar is an industry-acknowledged expert and public speaker and is regularly invited to speak and share his insights by some of the largest and most respected organisations in the world including The BBC, The Economist’s Intelligence Unit, The Financial Times, SC Magazine, InfoSec Magazine, Computer Weekly, The Register and the AlJazeera English Channel.

All trademarks, service marks, trade names, product names, service names and logos appearing on the site, or on printed or digital material are the property of their respective owners, including in Cyber Management Alliance Ltd. Any rights not expressly granted herein are reserved.