How to assist non - technical end users communicate effectively and concisely during incident response?
As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters but there are also employees at remote offices.
Today while researching a IDS alert, I had to reach out to a non - technical remote user at another office for additional information. The end user had trouble providing a lot of the information I was asking for - e.g: method of access, a clear description of what they see on their screen, their computer behavior at time of alert etc. I explained why I was asking for this information and restated the request in alternative ways, but it not help. The end user was just as confused. It was a frustrating experience, and in the end, I had to request assistance from another colleague.
Given the time sensitive nature of the task, and that a potential security incident was occurring, there was not enough time to teach the end - user , or guide them in detailed procedures. It was painful watching in the SOC of continued SIEM alerts for which response was hampered.
As I cannot physically interact with my colleague, what else could I have done to improve communication?
Alternatively, what can InfoSec, and more generally, IT employees do, to assist non - technical colleagues to communicate effectively in times of stress / emergency?
communication colleagues united-states security
asked 9 mins ago
AnthonyAnthony
5,6911657
add a comment |
As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters but there are also employees at remote offices.
Today while researching a IDS alert, I had to reach out to a non - technical remote user at another office for additional information. The end user had trouble providing a lot of the information I was asking for - e.g: method of access, a clear description of what they see on their screen, their computer behavior at time of alert etc. I explained why I was asking for this information and restated the request in alternative ways, but it not help. The end user was just as confused. It was a frustrating experience, and in the end, I had to request assistance from another colleague.
Given the time sensitive nature of the task, and that a potential security incident was occurring, there was not enough time to teach the end - user , or guide them in detailed procedures. It was painful watching in the SOC of continued SIEM alerts for which response was hampered.
As I cannot physically interact with my colleague, what else could I have done to improve communication?
Alternatively, what can InfoSec, and more generally, IT employees do, to assist non - technical colleagues to communicate effectively in times of stress / emergency?
communication colleagues united-states security
asked 9 mins ago
AnthonyAnthony
5,6911657
add a comment |
As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters but there are also employees at remote offices.
Today while researching a IDS alert, I had to reach out to a non - technical remote user at another office for additional information. The end user had trouble providing a lot of the information I was asking for - e.g: method of access, a clear description of what they see on their screen, their computer behavior at time of alert etc. I explained why I was asking for this information and restated the request in alternative ways, but it not help. The end user was just as confused. It was a frustrating experience, and in the end, I had to request assistance from another colleague.
Given the time sensitive nature of the task, and that a potential security incident was occurring, there was not enough time to teach the end - user , or guide them in detailed procedures. It was painful watching in the SOC of continued SIEM alerts for which response was hampered.
As I cannot physically interact with my colleague, what else could I have done to improve communication?
Alternatively, what can InfoSec, and more generally, IT employees do, to assist non - technical colleagues to communicate effectively in times of stress / emergency?
communication colleagues united-states security
asked 9 mins ago
AnthonyAnthony
5,6911657
As a member of the Information Security team at my workplace, triaging, researching, and escalating if necessary of SIEM / IDS alerts is one of my job duties. I work at central company headquarters but there are also employees at remote offices.
Today while researching a IDS alert, I had to reach out to a non - technical remote user at another office for additional information. The end user had trouble providing a lot of the information I was asking for - e.g: method of access, a clear description of what they see on their screen, their computer behavior at time of alert etc. I explained why I was asking for this information and restated the request in alternative ways, but it not help. The end user was just as confused. It was a frustrating experience, and in the end, I had to request assistance from another colleague.
Given the time sensitive nature of the task, and that a potential security incident was occurring, there was not enough time to teach the end - user , or guide them in detailed procedures. It was painful watching in the SOC of continued SIEM alerts for which response was hampered.
As I cannot physically interact with my colleague, what else could I have done to improve communication?
Alternatively, what can InfoSec, and more generally, IT employees do, to assist non - technical colleagues to communicate effectively in times of stress / emergency?
communication colleagues united-states security
communication colleagues united-states security
asked 9 mins ago
AnthonyAnthony
5,6911657
asked 9 mins ago
AnthonyAnthony
5,6911657
asked 9 mins ago
AnthonyAnthony
5,6911657
asked 9 mins ago
AnthonyAnthony
5,6911657
asked 9 mins ago
AnthonyAnthony
5,6911657
5,6911657
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "423"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworkplace.stackexchange.com%2fquestions%2f126100%2fhow-to-assist-non-technical-end-users-communicate-effectively-and-concisely-du%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to The Workplace Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworkplace.stackexchange.com%2fquestions%2f126100%2fhow-to-assist-non-technical-end-users-communicate-effectively-and-concisely-du%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
