REMEMBER - Data does not equal information, and information does not equal understanding. Very important for Incident Response

From Bruce Schneier's Blog:

Automation has its place in incident response, but the focus needs to be on making the people effective, not on replacing them ­ security orchestration, not automation.

In a world of uncertainty, the focus is on execution. In a world of certainty, the focus is on planning.

When things are uncertain, you want your systems to be decentralized. When things are certain, centralization is more important. Good incident response teams know that decentralization goes hand in hand with initiative. And finally, a world of uncertainty prioritizes command, while a world of certainty prioritizes control.


For More Info:
https://www.schneier.com/blog/archives/2017/03/security_orches.html