97 Things Every Information Security Professional Should Know

Chapter 57. The Psychology of Incident Response

Melanie Ensign

One of the most commonly overlooked aspects of effective incident response (IR) is the intellectual and practical mastery of self-regulating our reactions as individuals and organizations. In particular, many IR plans fail to consider the necessary steps to avoid, minimize, or recover from a state of panic within the security team or surrounding stakeholders such as executives, regulators, and customers.

Avoiding Panic

When we are panicked, we are unable to self-regulate effectively. This is because when panicked, the brain’s ability to consume and process large amounts of information is temporarily suspended as resources are diverted to reflexive and instinctive behaviors. Knowing how to avoid or minimize panic is important for ensuring the decisions we make and actions we take in the wake of a security incident are appropriate and productive for both short-term and long-term objectives.

Panic often reflects a gap in readiness. Whether technical, procedural, or relational, these gaps exist between the actual demands of an incident and the organization’s current skills, tools, and preparedness.

Anticipating Stakeholder Readiness

It’s not only a security team’s readiness that matters, but also each of their stakeholder’s ability to regulate emotional and physical reactions that impacts how well they can direct and ...