Mfcttrf

Why don't short runways use ramps for takeoff?

How did astronauts using rovers tell direction without compasses on the Moon?

Exploiting the delay when a festival ticket is scanned

Is it possible for a particle to decay via gravity?

Can living where Earth magnet ore is abundent provide any protection?

Reading electrical clamp tester higher voltage/amp 400A

Should I intervene when a colleague in a different department makes students run laps as part of their grade?

Narset, Parter of Veils interaction with Matter Reshaper

Is it possible to tell if a child will turn into a Hag?

Patio gate not at right angle to the house

Boots or trail runners with reference to blisters?

Why would an invisible personal shield be necessary?

Correct word for a little toy that always stands up?

Word for giving preference to the oldest child

How can Paypal know my card is being used in another account?

Move arrows along a contour

What is this kind of symbol meant to be?

Unknown indication below upper stave

Raindrops in Python

Is there any way to work simultaneously on the same DAW project remotely?

Avoiding Implicit Conversion in Constructor. Explicit keyword doesn't help here

If the Moon were impacted by a suitably sized meteor, how long would it take to impact the Earth?

Would people understand me speaking German all over Europe?

Can you continue the movement of a Bonus Action Dash granted by Expeditious Retreat if your Concentration is broken mid-move?

How could I have handled my colleagues unavailability during security incident response better?

Handling fallout due to new security policiesHow to assist non - technical end users communicate effectively and concisely during incident response?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

0

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security incidents.

This afternoon I was researching some anomalous traffic from our SIEM and IDS systems. There was some alerts that I could not adequately resolve or confidently dismiss as non-issues, due to lack of knowledge of some applications we own. It just happens the two colleagues who I could have asked were not available, one on vacation and the other sick. I wanted to respect their time off, and so did not contact them.

Due to there being a potential security incident going on, the situation was very fluid, and I really felt my lack of complete knowledge and visibility into the workings of the applications where alerts were coming from hindered my ability to effectively respond. My manager was in a meeting and not immediately available to assist.

In the end, I documented my actions and analysis and provided my manager with my interpretation of the log files, and he completed the incident handling. I realize long term this may be a management issue in there is a need for greater cross training across team members. However:

Questions:

• In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?




• Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?

security

share|improve this question

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What has been your managers response to the incident? Were they happy with how you handled it? Is there a documented escalation procedure for this scenario?
  
  – Gregory Currie
  20 mins ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Gregory Currie , He was satisfied with what I did, given the information constraints. We do have a robust incident response policy approved by SecOps management and CISO, but such document is very high level and does not contain guidance on specific situations such as today
  
  – Anthony
  11 mins ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  At the very least, the escalation policy should include what should happen if there is an incident, and the SA is unable to triage due to lack of knowledge. Getting that sorted is a good first step. If part of the escalation policy is to escalate up the chain, that is what you do, and your question becomes moot. Obviously you want to improve your knowledge so this particular scenario doesn't arise so much.
  
  – Gregory Currie
  1 min ago
  

  
  
  
  

add a comment | 

0

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security incidents.

This afternoon I was researching some anomalous traffic from our SIEM and IDS systems. There was some alerts that I could not adequately resolve or confidently dismiss as non-issues, due to lack of knowledge of some applications we own. It just happens the two colleagues who I could have asked were not available, one on vacation and the other sick. I wanted to respect their time off, and so did not contact them.

Due to there being a potential security incident going on, the situation was very fluid, and I really felt my lack of complete knowledge and visibility into the workings of the applications where alerts were coming from hindered my ability to effectively respond. My manager was in a meeting and not immediately available to assist.

In the end, I documented my actions and analysis and provided my manager with my interpretation of the log files, and he completed the incident handling. I realize long term this may be a management issue in there is a need for greater cross training across team members. However:

Questions:

• In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?




• Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?

security

share|improve this question

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What has been your managers response to the incident? Were they happy with how you handled it? Is there a documented escalation procedure for this scenario?
  
  – Gregory Currie
  20 mins ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Gregory Currie , He was satisfied with what I did, given the information constraints. We do have a robust incident response policy approved by SecOps management and CISO, but such document is very high level and does not contain guidance on specific situations such as today
  
  – Anthony
  11 mins ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  At the very least, the escalation policy should include what should happen if there is an incident, and the SA is unable to triage due to lack of knowledge. Getting that sorted is a good first step. If part of the escalation policy is to escalate up the chain, that is what you do, and your question becomes moot. Obviously you want to improve your knowledge so this particular scenario doesn't arise so much.
  
  – Gregory Currie
  1 min ago
  

  
  
  
  

add a comment | 

I work as a security engineer / security analyst on the IT Security team at my workplace. One of my core job duties is triaging , remediating / containing, and as necessary, escalating of security incidents.

This afternoon I was researching some anomalous traffic from our SIEM and IDS systems. There was some alerts that I could not adequately resolve or confidently dismiss as non-issues, due to lack of knowledge of some applications we own. It just happens the two colleagues who I could have asked were not available, one on vacation and the other sick. I wanted to respect their time off, and so did not contact them.

Due to there being a potential security incident going on, the situation was very fluid, and I really felt my lack of complete knowledge and visibility into the workings of the applications where alerts were coming from hindered my ability to effectively respond. My manager was in a meeting and not immediately available to assist.

In the end, I documented my actions and analysis and provided my manager with my interpretation of the log files, and he completed the incident handling. I realize long term this may be a management issue in there is a need for greater cross training across team members. However:

Questions:

• In such fluid demanding quick response, but for which I did not have full knowledge to fully and effectively respond, how could I have responded better without reliance on my manager?




• Given I am in a senior role, how can I best justify the cost of additional cross training to management? How can a proposal to management be made more concrete?

security

share|improve this question

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

share|improve this question

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

share|improve this question

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges

asked 21 mins ago

AnthonyAnthony

6,3361616 silver badges6262 bronze badges