97 Things Every Information Security Professional Should Know

Chapter 13. Take a Beat: Thinking Like a Firefighter for Better Incident Response

Catherine J. Ullman

The security world is full of dumpster fires these days. Unfortunately, incident response doesn’t come naturally to an operational mindset where the focus tends to be on reactive problem solving. As a volunteer firefighter for over twenty years, and an incident responder for more than half of that time, I’ve learned a lot about what is and isn’t effective in each. There are surprising parallels between fighting real-life fires and the firefighting that passes for today’s incident response. Let’s consider two: the need for patience and the importance of avoiding tunnel vision.

First, let’s discuss the need for patience. Striking a balance between swift response and patient reflection is often the difference between life and death, in a very literal sense for the firefighter and a figurative sense for the security professional. There’s a strong temptation to want to jump right in when someone yells, “Fire!” What I’ve learned, however, is that patience really can be the key to a successful incident response, just as in the fire service. As much as firefighters weigh the risks involved in their plan of attack, incident responders need to do the same.

Taking a beat—one moment to think through your approach—can be the difference between success and failure. During that pause take the ...