Cliff Stoll
termsecurityops culture
The Berkeley astronomer turned accidental investigator who, told to reconcile a 75-cent accounting discrepancy in 1986, followed it to a West German intruder selling access to US military systems to the KGB - and wrote it up as The Cuckoo's Egg.
Stoll invented working incident response by having no idea it did not exist: he kept a paper logbook, printed sessions, built the first documented honeypot out of a fake defence project, and spent months persuading agencies that the case was real. Everything modern practice does - timeline, evidence handling, attribution caution, patient monitoring instead of instant disconnection - he improvised first. He then went back to astronomy and glassblowing, which the field finds delightful.
Also known as: clifford stoll, the 75-cent error, klein bottles