Incident Management - The Art of Herding Cats

No ratings

Presented at FirstConferenceKualaLumpur 2018 by

BT’s security team is constantly evolving to meet the threat landscape, and the needs of the business. A key part of that team is the security incident management team, who routinely take challenging and fast paced security incidents, investigate them and bring them to a successful resolution. Successful resolution is bringing back normal service, but we worry as much about lateral movement and understanding attackers actions as much as the remediation of the service being impacted.This is what we do.But how do we do it?During this talk I will show how incident managers go about their business day to day, beyond process and beyond formal training.• An insight into incident management at an organisation the size of BT with a footprint in 190 countries, employing 90,000 people with 120,000 endpoints, and being covered by a 4 security incident managers) o What is it and what it is not, we are not a technical team, we are investigators who draw on others expertise to solve complex worldwide problems o How we drive incidents to conclusion regardless of complexity or vagary o What are they key challenges that are faced by the team and how we learn from experience and avoid the many pitfalls they bring o How we engage across varied teams with very different skills and abilities and allow them to flourish and innovate o How we build and manage an effective communications stream o Command and control, pre-empting key events and potential incidents to keep assets and people safe. For example Cyber Monday, where preparation and effective communication is key o How we identify learning and bring that back to developing technical teams and also security teams  Post Incident Reviews • Identifying and driving security improvements post incident• Maintaining control of improvements • Bringing visibility of security risks trends to relevant stakeholders  War Gaming • How we plan war-games based on incidents we have expertise of, but also ones we don’t yet know but need to be prepared for. This drives maturity. • How these war-games are chosen. • An insight into the core skills required o Why softer skills are invaluable in bridging the gap between technical teams and senior stakeholders  How we manage and issue communications, and provide reassurance of the situation and the steps being taken  How we manage and fulfil expectations of senior management and board level executives  Why emotional maturity (EQ) is so vital to the role • Innovative projects that have been borne out of live incidents o How we have developed our team structure to include behaviours, problem management and training so we can get the root of an issue at pace and deliver learning and improvement across the business o How, over time, we have taken high priority complex incidents and delivered process that simplifies the remediation and allows front line teams to deliver the solutionThe goal of this talk would be to cover fundamental points that all sizes of IM teams could use to improve their service and communicate more effectively with their stakeholders. This is not a technical talk and would be of value to a team leader, strategist or Incident Manager.