1

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security incidents.

This afternoon I was researching some anomalous traffic from our SIEM and IDS systems. There was some alerts that I could not adequately resolve or confidently dismiss as non-issues, due to lack of knowledge of some applications we own. It just happens the two colleagues who I could have asked were not available, one on vacation and the other sick. I wanted to respect their time off, and so did not contact them.

Due to there being a potential security incident going on, the situation was very fluid, and I really felt my lack of complete knowledge and visibility into the workings of the applications where alerts were coming from hindered my ability to effectively respond. My manager was in a meeting and not immediately available to assist.

In the end, I documented my actions and analysis and provided my manager with my interpretation of the log files, and he completed the incident handling. I realize long term this may be a management issue in there is a need for greater cross training across team members. However:

Questions:

  • In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?

  • Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?

  • What has been your managers response to the incident? Were they happy with how you handled it? Is there a documented escalation procedure for this scenario? – Gregory Currie Aug 1 at 1:29
  • @Gregory Currie , He was satisfied with what I did, given the information constraints. We do have a robust incident response policy approved by SecOps management and CISO, but such document is very high level and does not contain guidance on specific situations such as today – Anthony Aug 1 at 1:37
  • At the very least, the escalation policy should include what should happen if there is an incident, and the SA is unable to triage due to lack of knowledge. Getting that sorted is a good first step. If part of the escalation policy is to escalate up the chain, that is what you do, and your question becomes moot. Obviously you want to improve your knowledge so this particular scenario doesn't arise so much. – Gregory Currie Aug 1 at 1:48
  • 3
    This is a management issue. – solarflare Aug 1 at 2:03
5

In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?

You did everything you could and should do in this situation. Ultimately it's the management's responsibility to determine how to handle situations like this and what/who the escalation path is.

Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?

The fact that this incident occurred should be enough evidence that training and an escalation plan are warranted... if they take security seriously... which they should.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.