A River Runs Through IT: What Whitewater Rafting Taught Me About Incident Response
10In today's cybersecurity threat landscape, it is not a question of "if" there will be an incident, but "when." Cybersecurity professionals are well aware of this. Even so, essential day-to-day needs often prevent or delay conversations about future incident response. It can also be challenging to discuss hypothetical incidents with other stakeholders who do not share the same vocabulary, perspective, or goals. I worked as a whitewater raft guide for two years. As I began my career in DFIR I was surprised by how often I came back to concepts from rafting to help me navigate the often rough waters of incident response. On the river, it's not a question of "if" you swim, but "when." From the owner of the company to the greenest guide, it is a given that you will learn not only how to do your day-to-day job, but also how to respond to inevitable emergency situations. In this talk, I will frame security investigation topics in a unique way, through a lens informed by lessons learned on the river. My goal is to spark new conversations about successful incident response both within cybersecurity teams and with other stakeholders. These topics and takeaways include:
- situational awareness
- ability to change approach based on current conditions
- emotions & emotional recovery under stress
- the importance of prior contingency planning & drills
- teamwork and understanding team roles for best performance
- the critical importance of knowing one's environment
- the ecosystem/community we are part of.
This talk is for a wide audience, including those new to cybersecurity, incident responders, security analysts, and security leadership.
Stef Rand, Incident Response Consultant, FireEye/Mandiant; https://twitter.com/techiestef
View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#BlueTeamSummit #IncidentResponse