Summary

This chapter covered how to create a risk registry and the format to use. As mentioned, a risk registry is not only critical for compliance purposes but also allows you to appropriately assess risk, track any changes in your organization, and ensure that you are making progress toward mitigating risks. We covered how to conduct a purple team exercise and showed a purple team report. Purple team exercises are a sign of a mature security program and are critical for implementing a trust-but-verify strategy in your security measures. The last position any incident responder wants to be in is responding to a critical incident that could have been mitigated or prevented if the team had just run a purple team exercise or a TTX and learned from those experiences. Finally, we covered some common gaps and shortcomings that are completely normal and discussed options for mitigating those gaps.

In the next chapter, we’ll cover different threat models in detail and discuss how...