Policy Procedures
Policy procedures literacy names IR policy, standard operating procedures, and escalation paths — read plan tiers on YOUR $IR_LAB notes before live incident activation.
Visual · t34_policy_procedures
Policy procedures literacy. $IR_LAB only. Original Cyberlium.
Plans beat panic — literacy teaches IR policy and procedure structure on tabletop notes you own before production incident declaration.
IR policy defines when an event becomes an incident, who can declare, and what evidence handling rules apply. Procedures spell step-by-step actions — intake form fields, severity assessment, comms templates. Escalation paths name who gets paged at each tier. Literacy names these documents before you run a drill. Cyberlium maps policy procedures on YOUR $IR_LAB — document fictional policy excerpts and procedure steps on paper. Next: Severity Matrix.
1. IR document tiers (named)
Policy: board-approved rules — incident definition, authority to declare, legal hold triggers. Procedures: repeatable steps — intake, triage, evidence chain. Runbooks: tool-specific commands for YOUR org assets only. Escalation matrix: who to notify by severity and time of day.
On $IR_LAB, write one fictional policy sentence and one procedure step for a tabletop phishing inject.
Command guide
Try these commands — IR document tiers (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why policy literacy prevents rogue IR
Ad-hoc containment without policy backing creates legal and operational risk. Missing escalation paths delay executive and legal involvement. Mature IR programs version-control policy and test procedures in tabletops.
Students label document types on lab notes — never run destructive containment on employer production without declared incident and ticket scope.
3. Lab boundary
Forbidden: treating personal lab notes as binding policy for stranger organizations. Allowed: policy procedures card — four document types with $IR_LAB fictional examples.
Ship: policy procedures card for YOUR lab notes. Next: Severity Matrix.
4. What you ship: policy procedures card for $IR_LAB
Four document types with fictional lab examples. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Policy procedures card. $IR_LAB named. File t34-m02-l01-policy-procedures.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip policy and isolate systems ad hoc. Copy live victim IR policy without redaction.
- Right: Write policy procedures card for YOUR $IR_LAB. Next: Severity Matrix.
Mission: map IR policy on YOUR lab
1) Define policy, procedure, runbook, escalation in one sentence each. 2) Write one fictional example per type. 3) Name which role owns each document. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Policy answers 'may we?' — procedures answer 'how do we?' Label before you drill.
APPLY: IR policy primarily defines:
APPLY: True or False: Procedures spell repeatable step-by-step IR actions.
APPLY: Policy procedures literacy on Cyberlium uses: