Thoughts of a fledgling Incident Responder: one month in

As stated in my recent posts, I've made another career switch. This time, I'm dipping my metaphorical toes into the increasingly mission-critical area of most businesses: that of cyber security. The new look that I've applied to this blog, that of a darkened forest, is an analogy that I find apt. In broad strokes, most people are aware of its existence, yet few have explored it to find the diversity of the elements which comprise it. 

Being such a neophyte myself I count myself as especially fortunate, to be in a team where there are already experts I could call upon, where we have the potential to leverage powerful, industry-leading tooling, and in an environment where every employee is called upon to actively protect not only our own data and assets, but those we are entrusted with by our clients. 

In fact, it was immediately apparent that one has no choice but to take this role seriously if only because my employer's clientele consists mostly of organizations that collectively affect the lives of literally millions of people: if even one industry's portfolio of applications that we have designed and maintain were to stop working, large swathes of society would logistically be crippled. As digital data grows not just in size and extensiveness but in how integral it becomes to life decisions, be they for individuals or at the federal government and international perspectives, so too does the relevance of protecting it and preventing its exfiltration and abuse.

That I couldn't find many public anecdotal tales from other incident responders didn't surprise me: the very nature of this job requires a strict and almost absolute amount of secrecy that shrouds the details of the day to day workload that we handle. On the other hand and contradictorily, the definition of my new role and the varied playbooks that we follow seem ubiquitous online so I'll spare the reader a redundant attempt to cover those here or in future blogs.

I've encountered several comparisons of IRs to that of fire fighters and other responders: ignoring the urge to shy away from complicated and impactful events, we rather rush towards them, ideally with a level head and serving as an effective source of support to those already embroiled in it.

I look forward to chronicling more thoughts in the months to come, particularly as I gain more insights in not just handling, but (hopefully) thriving in this role.