Incident Response

Ad Hoc Teams

If you’ve gone through this list of team types and you still believe that none of them can possibly work in your organization -- perhaps because you can’t get upper management buy-in -- there’s still an alternative. You may want to consider setting up an ad hoc team of, for example, system administrators and related technical staff. Simply coordinating off-hour points of contact of key staff and discussing the possibility of what to do during an emergency can be better than no planning at all. That team should include the various IT support staff, but don’t neglect to list some of the key senior management staff. Many times, when an incident occurs at organizations without formal security groups or contracts with commercial incident response teams, managers run into the IT department and pluck whoever is available at the time to deal with a reported incident. Such impulse actions usually hinder the effective resolution of an incident.

An ad hoc team should only be considered as a last resort. Any inkling of senior management buy-in will always be preferred, and proceeding without that buy-in could have career-limiting effects. However, in the event of a real security crisis -- where business operations may be impacted -- your contact list and planning, albeit limited, may prove invaluable in responding rapidly with some degree of success. Most managers will tell you that being effective means knowing the capabilities of your people. The same holds true for incident ...