Keep a security incident runbook and rehearse it

How to do it

In a breach, the first hour decides how much leaks. Write the steps in order. Declare the incident as Declare incidents early says, and copy logs before anything changes, as Keep evidence in security incidents says. Then revoke sessions and tokens, rotate keys and passwords from the secret list, and block the way in. Start the legal clocks from Plan for a data breach. Keep each step as a script that one person can run, since a page of manual steps fails under stress. Note the drill time and every step that failed.

Examples

JavaScript example

export async function revokeAllSessions(db, now = new Date()) {
  await db.query('UPDATE sessions SET revoked_at = $1 WHERE revoked_at IS NULL', [now]);
  await db.query('UPDATE settings SET tokens_valid_after = $1', [now]);
}

Python example

def revoke_all_sessions(db, now):
    db.execute("UPDATE sessions SET revoked_at = %s WHERE revoked_at IS NULL", (now,))
    db.execute("UPDATE settings SET tokens_valid_after = %s", (now,))

How to check

The last drill is under 12 months old. In it, every session token issued before the drill answered 401 within 15 minutes of the revoke script. Every rotated secret's old value was refused, and the preserved logs cover the 24 hours before the drill.

Sources

• NIST SP 800-61 Rev. 3 Incident Response Recommendations

Related rules

• OPS-25 Declare incidents early in Operations and observability
• OPS-30 Keep evidence in security incidents in Operations and observability
• CMP-71 Plan for a data breach in Compliance and governance