One thing about the DFIR blogs is that they tend to bounce off each other. This is a good thing because tidbits of gold nuggets can be expanded upon with different perspectives and experiences. Never in human history have we ever been able to instantly connect world-wide to increase our knowledge base, especially in the technology field (specifically in the DFIR field!).
With that, to expand on Harlan Carvey’s never-ending quest to push ourselves to share, I want to credit those who do share as I constantly benefit personally and professionally from the work of others. For those who do not yet share, consider the benefits you will have by putting yourself out there, even just a little. We are all smarter only because we communicate with each other.
I have seen polar opposites of how sharing knowledge works and how hoarding knowledge does not. As I was a Marine at 17 years old, I had an unfair advantage of the benefits of sharing. I never heard the actual word “sharing” in the Marines, but that is what we did. We shared knowledge and experience. From day one in the Fleet, I was shown the way to do ‘things’. I was given the opportunity to try, fail, try, fail, try, fail, try, succeed. No one ever gave up on me, nor wanted me to fail. When my turn came to lead, I did the same to the boots that came in. I showed them the way and made sure they were competent. Allowing the failure of a Marine was not an option. I naively believed that was the normal way of doing business everywhere, but I was wrong.
Enter the private sector….
I have had both similar experiences in the private sector and a completely opposite experience. The experiences that I had that were opposite in that I never expected professionals to hoard knowledge from their peers. Co-workers, peers, and supervisors seemed to be on warpaths to make sure the newbies failed. Those who did not fail were allowed to stay. Those who failed were booted out the door. Trial-by-fire was the method of training new employees. I have even seen the sabotage of new employees in hopes to flunk them out.
- When the team shares, teaches, encourages, and supports each other, the team grows and bonds together. This team can tackle anything that comes up, without hesitation, and without worry of being left to drown by an individual in their team. Expect failures, but also expect the failures to be turned around into successes.
- When you have individuals who are only looking out for #1, your team isn’t a team. It is a group of individuals, each with a different agenda. Expect failures. Don't expect success.
Having been in both types of situations, I can say without hesitation that when people share knowledge, everyone grows and benefits including the person who is sharing. In the world of DFIR blogging, whether you are in a one-person company or working for a Fortune 50 organization, when you share your knowledge, you benefit more than you know. If you are being paid as a leader in your organization, under whichever term (manager, supervisor, TL, etc...), your mission is to give every opportunity to grow your team. Some tips:
- Teach, show, do (you are a teacher. teach your members, show them how, let them try. rinse and repeat)
- Don't give up (if your member keeps trying, so do you. have patience)
- Teamwork (team success, not individual wins, makes for success)
- Teach your peers and subordinates to succeed individually for the group and the unit will succeed as a team.
How does this apply to a DFIR blog?
Your blog is affects everyone in the field. It is shared. It is talked about. It is critiqued. It is criticized. It is praised. It initiates conversation. And most importantly, it moves the DFIR field forward. Whether your blog moves us an inch forward or a light-year into the future, you are a part of it. To those who don’t believe this, you don’t have to believe it. We reap what we sow. To everyone else, I’m merely preaching to the choir (and I bet your team rocks).
PS. this applies to any line of work, but when our work is 'in computers', dude, we practically work on the Internet so share your brain :)