One of the more frustrating aspects of working in security is seeing a danger that few others seem concerned about.

This can be even more upsetting when it feels like your employer has little interest in responding to your recommendations. You've seen the problem, documented the potential impacts to the organization, and proposed controls to decrease those impacts. All to no avail. What can you do?

One answer is to create a plan to respond to the incident that could occur if the wreck happens. That way you are ready and are the one with the plan to right the ship.

Making the Plan

How you go about doing this will depend on how you work best.

For me this involves getting a blank sheet of paper and drawing out a diagram that starts with the event, then branches off down different paths based on what could happen. For example, if someone falls for a malicious email, they could be phished for credentials or install remote access software. If it was a phishing message, then the diagram branches off into different steps to take in response.

However you develop your plan, make sure to document in whatever is appropriate at your business. A document, a wiki page, or whatever.

Let People Know About the Plan

Once you've got things documented, let others know about it. Ask someone responsible for desktop support to look it over. Ask your manager to review it. What did you miss? Add in their suggestions.

The benefit here is that they know you've created a response plan and you've asked for their expertise. They become a bit more invested in it and they know it exists.

In the end, you and your employer are better prepared if the risk you've spotted turns into an incident. It won't be a perfect plan, but you'll be far better off than not having a plan at all.

Developing your ability to do this is also significant skill to have in your arsenal.