Você se depara com vários incidentes de segurança. Como você prioriza e responde de forma eficaz?

The priority should be to stop the bleeding...and once you've figured that out, you can take a breath and start looking at the total impact. Depending on your organization, the priority may need to be discussed in the context of regulatory requirements - what someone else deems important. Otherwise, make sure that your impact analysis takes into consideration the financial, operational, technical, and reputational aspects of what's happening to your organization. And then make sure that the right people are weighing in on each of those aspects.

Identify what systems and confidential data of the customers is at risk. Understand and identify the impact of the incidents Put them into diffrent categories and setup priorities accordingly.

This is where your IR plan playbooks come into the mix. But remember, you may NOT know the threat...or you may think you know and through analysis it turns out to be something else. Rarely do attackers stick to just one type of attack. Use your playbooks to work through the process - and remember that you can have more than one playbook going at a time. Each one is giving directions on how to respond based upon that type of threat. Be fluid in the response and understand that as the information is analyzed, you may find another threat. And always have playbooks - no one can ever think straight 100% of the time while their hair is on fire. Set your IR team up for success and then give them the tools to execute.

Work on the top priority incidents first and try to safegaurd the systems and data as soon as possible, write down the problem clearly as it solves half of the problems. Involve all the teams associated with the incidents right from architects to the operations team. Raise tickets with vendors like cloud etc to understand the initiation of the incidents. Identify the root cause, eradication and mutigation steps and implement them.

This is arguably the most important part of incident response - the after-action report. When conducting this review, remember that you have the added benefit of 20/20 vision after the fact to see those things that didn't quite go as expected. Don't use this as a time to place blame - if the process was followed, then the decisions made were based upon those processes and the information available at the time. Update the process instead of blaming the people. Too many times responders are berated for doing something that turned out negative when they followed instructions to the "T". This doesn't mean they were "wrong". If they didn't follow process...well, that's a whole other conversation.

Document everything that has happened during the incidents, take out lessons learnt. Implement permanat eradication solution so that such incidents do no arise in future, setup approprite monitoring for alarming the necessary teams to take required actions. Setup some auto remediation.