5 - Kasturi Puramwar

### Overview In this talk, Kasturi Puramwar, manager of the West Region Incident Response (IR) team at Equinix, presents a two-part session on standardizing cybersecurity incident response runbooks and her personal journey through competitive bodybuilding. Addressing common operational hurdles such as repetitive tasks, onboarding friction, and audit tracking, Puramwar outlines how her organization shifted away from dense text manuals to structured graphical runbooks. She details the governance framework, approval gates, visual standardization standards, and review cycles that ensure consistency and cross-functional alignment. In the second half, she connects the core values of incident response governance—such as discipline, consistency, and time management—to her 10-month preparation for a bodybuilding competition.

### Key Topics - **Transition to Graphical Runbooks:** Shifting from exhaustive, step-by-step written manuals to visual, single-screen graphical flows to reduce ambiguity and keep responders focused. - **Multi-Tiered Approval Gates:** Establishing three formal review gates (Runbook Committee, Stakeholders, and IR Management) to enforce standards, achieve cross-functional buy-in, and maintain alignment with high-level goals. - **Standardized Templates Aligned with NIST:** Mapping response workflows into swimlanes categorized by NIST incident response lifecycle phases (Preparation, Detection and Analysis, Containment, Eradication and Recovery, Post-Incident). - **Runbook Governance and Committee Structure:** Operating a rotating committee (chair, member, management sponsor) to oversee quality assurance, maintain standards, and execute scheduled review cycles. - **Discipline and Habit Building:** Applying the principles of consistency, intentional discomfort, and rigorous time management learned through bodybuilding preparation to high-pressure security operations.

### Technical Details - **Diagramming & Knowledge Base Stack:** The team utilizes Lucidchart for visual diagramming, structuring process maps across dedicated swimlanes for various actors (process developer, peer reviewer, committee, stakeholders, management). Diagrams and supporting documentation are hosted centrally in Confluence using structured page trees. - **Process Flow and Versioning:** Development moves through strict version milestones: - `0.1`: Initial process draft created by the runbook owner after scoping stakeholder needs. - `0.2`: Peer review completed to evaluate thought process and logic. - Stakeholder Feedback: Initial draft reviewed by relevant groups (e.g., SOC, GRC, Legal, HR, Product Security, WAF teams). - `Gate 1 (x.4)`: Runbook Committee approval ensuring adherence to formatting and structural rules. - `Gate 2`: Cross-functional stakeholder sign-off, walking through ownership tasks and eliminating operational assumptions. - `Gate 3`: Incident Response Management approval verifying alignment with organizational objectives. - **Template Architecture and Shape Bank:** - Layout standard enforces movement strictly from left to right and top to bottom. - Dedicated sections for references (linking supplementing documents, playbooks, or charts) and an approval block recording quality assurance verification, dates, approver names, and organizations. - Pre-defined 'Shape Bank' embedded at the bottom of the template with standard semantic styling: red borderlines indicate embedded hyperlinks (linking child processes or Confluence pages), yellow denotes decision boxes (where branching follows standardized logic, defaulting to 'Yes' continuing to the right), and system name indicators show specific platforms where actions take place (e.g., Outlook notifications). - **Lifecycle Maintenance:** A mandatory six-month review cycle is applied. Runbooks older than six months are flagged for the original owner and committee to evaluate whether underlying technologies, tools, or procedures require updates.

### Takeaways - Standardizing runbook creation with visual diagramming improves responder speed, smooths onboarding, and provides clear audit documentation. - Involving cross-functional stakeholders early and requiring documented sign-offs eliminates operational assumptions and establishes clear ownership across teams. - A rotating governance committee distributes leadership experience across responders while ensuring long-term maintenance of documentation. - Sustainable success in both complex technical workflows and personal physical milestones depends on consistency, discipline, and incremental progress over fleeting motivation.