I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security incidents.
This afternoon I was researching some anomalous traffic from our SIEM and IDS systems. There was some alerts that I could not adequately resolve or confidently dismiss as non-issues, due to lack of knowledge of some applications we own. It just happens the two colleagues who I could have asked were not available, one on vacation and the other sick. I wanted to respect their time off, and so did not contact them.
Due to there being a potential security incident going on, the situation was very fluid, and I really felt my lack of complete knowledge and visibility into the workings of the applications where alerts were coming from hindered my ability to effectively respond. My manager was in a meeting and not immediately available to assist.
In the end, I documented my actions and analysis and provided my manager with my interpretation of the log files, and he completed the incident handling. I realize long term this may be a management issue in there is a need for greater cross training across team members. However:
Questions:
In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?
Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?
