From Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response
summary
An analyst finds a threat actor’s engineering workstation revealing novel TTPs used in three separate incidents, which enables seizure of infrastructure and coordinated remediation; brief recommendations emphasize starting with BLUF and the five W's, binding urgency to impact, and using the triple-constraint model (accurate vs timely vs comprehensive) to set expectations. Operational tips: avoid single points of contact, escalate gradually, keep OOB channels like Signal, and submit candidate vulnerabilities via the new KEV submission form for faster prioritization.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:27Technical communication pitfalls
- 3:55Miscommunicated threat intelligence
- 5:40Cyber security operations shifts
- 9:53Briefing frameworks
- 14:52Political sensitivities in teams
- 17:03High-pressure incident response
- 22:44Key takeaways
- 27:46Q&A
related talks
51mReal World Stories of Incident Response and Threat Intelligence
49mTraining for Incident Response: The Red, the Blue, and the Ugly
41mHow to Keep Your Cool and Write Powerful Incident Response Reports
49mIR: Optimizing Communications and Action Between Legal and Tech Leaders
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
51mLife after the Breach: A Survivor's Guide
01h 00mWhat Was I Thinking?: Bungled Breach Responses
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage