The Practice
How the work is actually done.
Networks and security, from the inside: triage, escalation, evidence, handover, the rota. Not how the technology works, which is covered elsewhere on this site, but how the job is done by the people who do it.
Two ways to read this
The parts below are in order, and the order is the life of a system: before it breaks, when it breaks, when it will not yield, after it is over, the life around it, and the craft underneath all of it. Read top to bottom and you have been walked through the whole arc.
Or arrive holding one question, read one article, and leave. Each entry shows what it argues rather than what it covers, because somebody scanning for the one about escalation is matching a question to an argument.
Where each article's authority comes from
Thirty years is long enough to have done a great deal and nowhere near long enough to have done everything. So every article declares which it is, and the marker sits above the text rather than below it.
- Practised — Work done repeatedly, in production, by the author. (1)
- Witnessed — Work the author was present for or adjacent to, but did not own. (0)
- Documented — The established discipline, described and sourced. No first-hand claim is made. (0)
The reason is simple: a corpus this size, published under one name, would otherwise imply first-hand experience of every subject in it. That would not be true, and a site whose tools compute rather than guess should not make claims it cannot support.
II. When it breaks
The arc of a single incident, from the moment somebody notices to the moment service is restored.
Where this has got to
1 of a planned 48 articles are published. The corpus is written a part at a time and finished rather than sketched, so an empty part below means it has not been started, not that it was forgotten.