https://www.sans.org/reading-room/whitepapers/analyst/maturing-specializing-incident-response-capabilities-needed-36162