tl;dr I have an article about incident management up.
Back in February, Virginia Bryant from GitHub reached out to me. GitHub was spinning up a new online magazine, The ReadMe Project, on a model similar to Stripe’s Increment. She’d read my article about threat modeling there and liked it, and would I be interested in writing an article on a security topic for her magazine.
I really felt like I had said what I had to say about threat modeling for the time being, but, after chatting a bit about who her audience was and what their needs were, we settled on the topic of incident management.
Because I have so much to say on the topic from my years helping to run the incident management process at Akamai, but had a relatively short article to say it in, I decided to focus tightly on composing the incident email—although so much about structuring the overall process turned out to be latent in that.
As I discuss in the article, at the highest level, an incident email needs to include six things—
- What we are perceiving which causes us to believe that something bad may be happening;
- Our best guess right now of how bad it is;
- How far along we are in our response to it;
- Which one person is directly responsible for coordinating the response;
- Where we’re coordinating;
- Who else is involved and in what capacity.
—but so much emerges from that.
Working with Virginia and the ReadMe Project folks was a great experience, highly recommended, and many thanks to her and them for providing me this venue to talk about a thing that I’ve wanted to talk about for a long time.
It turns out that I have a lot more to say about incident management, so I’m working to find more places to write about it in the future. (One is already in the works, on incident action items, so watch this space. 🙂 )
In the meantime, go check out the article!