Preparation, detection, and analysis: the diagnostic work of IT security incident response.

The article presents a study which examines the security incident response practices of information technology (IT) security practitioners as a diagnostic work process in Canada. The study notes the security incident response as a highly collaborative activity that may require such practitioners to develop their own tools to develop specific task. It also points out how the need of practitioners to rely on tacit knowledge and the usability issues with security tools complicate the diagnosis during incident response.