Josh Rickard

Josh Rickard has a diverse background from system administration, digital forensics, and incident response to managing teams and building security products. This chapter presents Rickard's answers to questions related to the blue team. He defines a blue team as anyone who supports, drives, trains, implements, or cares about the defense of an organization. Rickard believes that negotiation and communication capabilities are the two core capabilities that a blue team should have. He presents his views on some key strengths of an incident response program and some core metrics that a blue team can use to build, measure, and maintain a successful information security program. Rickard shares his approach to data governance and other methods of reducing data footprint, as well as strategies to communicate the threats he has encountered to nontechnical decision‐makers. He also provides recommendations for managing nontechnical executives' expectations during a significant ongoing incident.