Get. Out. Of. My. Head!

I had the honor to participate in the 26th FIRST Conference (www.first.org) this past week, learning  more than a few things in the sessions that I attended.  I felt compelled to sit in on one that had to do with using Anthropology to design better SOCs (how can you resist that?) and was glad I did- it certainly made me think!

One point that I really pondered was that it's just plain difficult to get the passive knowledge that people have and make it an explicit knowledge that can be documented and shared with others.  This is so true! How many times have we tried to train others on what we do, when it's all based on decisions that we personally make based on our experience?

If it's difficult for someone like me who strives to share the knowledge that I have gained, then imagine how hard it is for everyone.  The reason isn't that we don't want to share, either.  Its that we simply have trouble articulating our thought processes.  Some do this better than others.  Some never do.

Which brings me to the point:  we need to start figuring out how to do this better.  This applies to talking to management about why they should care about security risk.  And how to train our analysts to trust that funny feeling they have about that one little thing in the logfile they spotted, ignored the first time, but went back to check on later.  And how to get IT to work with us and not against us because together we can truly kick butt and make progress.

So how do we extract that passive knowledge?  I go back to the basics again:

1) Communication skills, both written and verbal

2) Applying critical thinking out loud

3) Plain old brainstorming.  Heck, make documentation fun!  Get a group together, make a game of it and encourage participation through some sort of competition.  The person with the more ideas wins a prize.  Also, provide food.

4) Reward sharing in general.  No silos.  Embed it into the group culture.

5) Practice.  Run through scenarios and capture actions.

These are just me throwing ideas out while I write this on a plane ride back from the conference.  I challenge all of you who read this to add one more idea.  Share your passive knowledge.  Make the community better.  Add value to the profession overall.  And then turn around and do it again!

Sent from my iPad=