Something that has served me incredibly well over years working incident response is willingness and capability to play devil’s advocate. When I’m told something is on fire, I take a moment to evaluate if it truly is. When I’m told something isn’t afire, I consider why it may be.
Which do I find myself doing more? To be honest, it’s often arguing against IT folks (and my better sales pitch) that things aren’t as catastrophic as they think. Panic is counterproductive to triage. I do plenty of arguing that conditions really do merit faster response, though.
Good science and investigation involves attempting to disprove hypotheses using quality evidence, methodology, and logic. To be a good investigator and responder, you need to be logical, collected, and always willing to challenge assertions (and have yours challenged as well).
Random shout out to two people in Infosec who are masters at doing this in the public space, @ErrataRob and @krypt3ia - sometimes it’s good to consider an opposing view. It exercises the brain.
You will not always make friends doing this in a professional space. Choose your battles. Be courteous and respectful, but do remember that disproving hypotheses and considering evidence from multiple perspectives is crucial to making decisions and sound analysis.
