I was hoping to find out what the blue team should have done in a real incident.

Does the blue team tech guy tackle the red team guy and restrain him? Give chase and hope the guy exits through a door with a security guard? Let him leave and hope the cops will care?

They're supposed to call in physical security. Many companies have security crews that are qualified and authorized to use force (and promptly call law enforcement.) Sometimes these crews are armed.

I read it all before posting here. I assume you're referring to this part:

> The DFIR lead leaned down next to my ear and whispered, "No one in Accounts Payable ever runs Powershell..."

> Alright... That last part had a bit of dramatization added to it.

I interpretted the "last part" to mean the part where the DFIR whispers in his ear.

I'm still not convinced this is real. It smells like fiction.

Dramatization === Fiction ?

Storytelling as a knowledge share is fundamental to human culture. Drama and story refinement are required to make the knowledge easy to remember and spread.

As for you being convinced, my personal experience is that this story is entirely believable. Many of us in security have stories we cannot share that would make this one look like a Saturday morning cartoon.

Dramatization has nothing to do with credibility. It is a memory facilitation technique. Because you the reader can remove the drama and distill the critical story elements for further inspection of credibility.

Credibility is found in the citations, which here is only the story teller. As that is only one data point, I totally understand doubting its credibility because one needs more citations and voices for proof.

Further, I never stated I found the story creditable. I was operating from a believability standpoint. Inferring one's experience to weight if the story could possibly be believed. You shared you found it hard to believe based on it's dramatization. Where I shared that I found it completely plausible based on my experience.

And that is my main argument, that in this equation drama shouldn't be used as a weight. Positive or negative.

Edit: For the folks down voting this. Please don't conflate dramatization with persuaion, propaganda, or fake news. Dramatization is a tool used in those techniques.

I don’t think so. It’s not hard to distinguish the dramatization.

> I'm still not convinced this is real. It smells like fiction.

Right? What shop has that good security. Even CRI would be easier to hack, and they're not even on the net.

I agree, quite a bit of this reads like fiction. The scenario itself suggests an uncommon level of competence, but assuming that's true then the rest is pretty believable for the same reason, if given to some dramatic license.

I read it to mean "next to last part".

It’s dramatized, probably to make something most would see as mundane palatable.

There are a lot of specifics for something that’s fictional.

Sorry, I couldn’t delete the comment a few minutes after making it, so I did the next best thing. I can’t do any more now.

He's making a joke. I thought it was clear.