CSIRTeaming: Forging Resilient Incident Management Teams with Psychological Safety

CSIRTeaming: Forging Resilient Incident Management Teams with Psychological Safety

Speakers: Yoshiki Sugiura, Founder, NTT-CERT

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=_QFM0qRI-BI

Overview

In his compelling FIRSTCON presentation, "CSIRTeaming: Forging Resilient Incident Management Teams with Psychological Safety," Yoshiki Sugiura of NTT-CERT unveils a critical paradigm shift for modern incident response. Drawing upon 27 years of experience in CERT activities and extensive research into High Reliability Organizations (HROs), Sugiura argues that the persistent failure of organizations to learn from incidents stems not merely from technical vulnerabilities or process gaps, but from fundamental deficiencies in team dynamics and organizational culture. His talk posits CSIRTeaming as the essential model for building truly resilient incident management capabilities.

Sugiura's core thesis is that while frameworks like CSIRT PSIRT services framework, Symmetry, and "The Art of Incident Management" provide valuable procedural guidance, they often overlook the "soul" of incident response: the human element. He highlights the pervasive issue of repeated incidents, attributing it to a lack of psychological safety within teams, which stifles error reporting, organizational learning, and effective collaboration. By integrating HRO principles with a deep understanding of psychological safety, CSIRTeaming aims to create an environment where teams can openly address failures, adapt dynamically, and ultimately achieve a state of genuine resilience against increasingly sophisticated threats.

This presentation is particularly timely given the escalating complexity and frequency of cyberattacks, especially ransomware, which often exploit not just technical weaknesses but also human and organizational dysfunctions. Sugiura’s insights offer a foundational approach to fortifying incident management teams, moving beyond mere technical solutions to cultivate the robust, adaptive, and trust-based cultures necessary for effective cyber defense. It’s a call to action for security leaders to re-evaluate their operational environments through a psychological and sociological lens, fostering environments where vulnerability is embraced, and learning is continuous.

Background

▶ Watch: Introduction: The Soul of Human Teaming (0:00)

Yoshiki Sugiura's journey in the realm of cybersecurity began on November 2nd, 1998, marking the start of a distinguished 27-year career in CERT activities. He joined JPCERT/CC in the same year and later established NTT-CERT in 2004, where he has since been a foundational figure. His long-standing engagement with the FIRST conference, attending since Chicago in 2000, underscores his deep commitment to the global incident response community. While initially a programmer, Sugiura's focus has evolved to encompass organizational social psychology and education, leading him to research HROs and psychological safety. This multidisciplinary background uniquely positions him to address the intricate human factors at play in incident management.

Sugiura’s current work builds upon previous efforts, including a co-presentation at the June 2024 FIRST conference in Fukuoka with Yusuke Kon, titled "The Art of Incident Management," which primarily focused on techniques and processes. However, in developing a training program based on that talk, Sugiura sensed a vital missing element. This realization led him to Amy C. Edmondson's "The Fearless Organization," which, while not fundamentally new to his accumulated experience, beautifully organized and articulated the principles he had instinctively practiced and studied. He recognized that the missing piece in existing frameworks – including CSIRT PSIRT services framework and Symmetry – was the human element: organization culture, leadership, and the critical concept of psychological safety.

The problem Sugiura identifies is a pervasive and alarming trend: organizations repeatedly fall victim to the same types of incidents, despite having established policies, measures, and processes. He points to numerous ransomware attacks in Japan, often stemming from basic oversights like unpatched VPN vulnerabilities, inactive unused accounts, or ignored distressed employees. These aren't always sophisticated attacks; rather, their root causes frequently lie in organizational dysfunction: a lack of reporting, simplification of issues, bias ("it's not a big deal"), being overwhelmed by other tasks, and a culture of shifting blame. Sugiura argues that the core issue is not a technical vulnerability, but rather a "functional failure" rooted in team dynamics and the human element, which prevents learning and continuous improvement.

Sugiura illustrates these challenges with three organizational issues:

1. Ignoring Minor Incidents: Teams often neglect small reports or minor weaknesses, assuming they are low priority or due to resource constraints. This procrastination allows minor issues, like VPN vulnerabilities or unused accounts, to escalate into major breaches. He emphasizes that handling minor incidents is paramount to preventing major ones.
2. Lack of Organizational Learning: When problems occur, the response often ends with reprimand and warning, simplifying the issue and blaming individuals. This stifles learning, preventing the organization from digging deeper into systemic causes and implementing Kaizen (continuous improvement). A culture of blame ensures that neither the individual nor the team truly learns from mistakes.
3. Team Silos: Departments become overwhelmed by their own work, creating barriers that trap problems within single units. Incident response, by its nature, requires cross-functional collaboration. When CSOC monitoring, response, and risk management teams, despite sharing common goals, fail to function dynamically and instead remain static and isolated, effective incident handling is severely hampered.

These challenges collectively highlight the urgent need for a new approach that prioritizes the human and cultural aspects of incident management, moving beyond purely technical or procedural fixes.

Key Findings

▶ Watch: Miles Davis Anecdote: Treating Errors as Events (11:40)

Sugiura's talk culminates in the proposal of CSIRTeaming, a model designed to forge genuinely resilient incident management teams by integrating the principles of High Reliability Organizations (HROs) with psychological safety. This fusion provides the critical "soul" missing from purely procedural frameworks, offering a path to leverage existing methodologies effectively.

The foundation of CSIRTeaming rests on the tenets of HROs, entities like nuclear power plants, aircraft carriers (e.g., USS Carl Vinson), and hospitals that maintain near-perfect safety records in high-pressure, high-risk environments. Pioneering research by Dr. Karl E. Weick and, in Japan, by Dr. Nakanishi (Sugiura's co-author) and the late Dr. Suguru Yamaguchi, revealed five core principles for HROs:

1. Preoccupation with Failure: HROs are not just concerned with preventing failure but are obsessed with small signs that could precede larger failures. They actively welcome minor incidents as precursors, refusing to ignore frontline concerns.
2. Reluctance to Simplify: Recognizing the inherent complexity of reality (people, systems, processes, attackers), HROs never simplify causes. They dig deep beyond single technical root causes into organizational and psychological factors.
3. Sensitivity to Operations: Constant attention is paid to information from the constituency and the broader community, ensuring a real-time awareness of the operational environment.
4. Deference to Expertise: In HROs, opinions of those with the most experience or knowledge are respected, regardless of their hierarchical position, fostering an environment where insights flow freely.
5. Commitment to Resilience: HROs prioritize the ability to recover quickly from unexpected events and, crucially, to learn from those events, continuously adapting and improving.

Central to these HRO principles, and indeed to CSIRTeaming, is psychological safety. Sugiura references Amy C. Edmondson's 1999 paper, which popularized the concept, defining it as "a shared belief held by members of a team that the team is safe for interpersonal risk-taking." Its roots trace back further to Edgar Schein and Warren Bennis at MIT in the mid-20th century, who identified it as essential for overcoming "learning anxiety" during organizational change. Edmondson's research on medical teams revealed a paradox: high-performing teams reported more errors, not because they made more, but because they felt safe enough to report them without fear of reprisal, leading to better learning and outcomes. A fearless organization is not merely a "nice group" but one where constructive conflict and learning are actively encouraged.

Teaming itself is defined as the act of people coming together across organizational frameworks to collaborate, solve, and learn in response to tasks or crises. It emphasizes dynamic, flexible collaboration rather than static departmental structures. The leadership required for such teaming, as exemplified by figures like Miles Davis or Captain Jean-Luc Picard, is crucial for fostering an environment where HRO principles and psychological safety can thrive. CSIRTeaming, therefore, is the practical application of these integrated principles, providing the key to effectively leverage existing service frameworks and "The Art of Incident Management" for building truly resilient organizations.

Technical Deep Dive

▶ Watch: High Reliability Organizations (HRO) Principles (12:40)

While "technical" in the traditional sense often refers to code, protocols, or system architectures, in the context of CSIRTeaming, the "technical deep dive" refers to the detailed exposition of the underlying psychological and organizational mechanisms that drive effective incident response. Sugiura's presentation meticulously unpacks these concepts, demonstrating how they form a robust framework for human-centric resilience.

The High Reliability Organization (HRO) framework is not merely a set of guidelines but a deeply ingrained cultural and operational philosophy. Sugiura emphasizes that HROs view errors not as individual faults to be eliminated, but as systemic failures or, more constructively, as data points for future improvement. The anecdote of Herbie Hancock playing a "wrong chord" during a Miles Davis quartet performance perfectly illustrates this. Miles Davis, instead of chastising the mistake, responded by playing a phrase that made the "wrong" chord sound "right," later stating, "I did not hear it as a mistake. I heard it as an event and I responded to it." This mindset—treating anomalies as events to be processed and learned from, rather than failures to be punished—is the cornerstone of HROs.

Sugiura elaborates on the five principles of HROs:

• Preoccupation with Failure: This goes beyond simple vigilance. It's an active search for "weak signals" – minor incidents, overlooked reports, small concerns from frontline staff. These are not dismissed but are seen as potential harbingers of larger systemic issues. For a CSIRT, this means meticulously logging and analyzing even seemingly insignificant alerts, rather than triaging them away due to perceived low priority or resource constraints.
• Reluctance to Simplify: In incident analysis, an HRO environment resists the urge to blame a single person or point to a single technical vulnerability. Instead, it demands a deep dive into the "why" behind the "why," exploring the organizational, cultural, and psychological factors that contributed to the incident. This could involve examining communication breakdowns, resource allocation issues, or underlying biases, ensuring that the true root causes are identified, not just superficial symptoms.
• Sensitivity to Operations: This principle mandates a constant, real-time awareness of the operational environment, both internal and external. For a CSIRT, this means not only monitoring internal systems but also actively engaging with constituents, staying abreast of community intelligence, and understanding the evolving threat landscape. It's about maintaining an acute perception of the current state of affairs, enabling proactive rather than reactive responses.
• Deference to Expertise: In an HRO, hierarchy takes a backseat to knowledge and experience during critical situations. The person with the most relevant information or expertise, regardless of their rank, is empowered to speak up and lead. This is crucial in incident response, where the most junior analyst might possess critical, real-time insight that senior management lacks.
• Commitment to Resilience: This is the ability to absorb shocks, adapt, and recover quickly. It’s not about preventing all failures (which is impossible) but about building the capacity to bounce back stronger. This involves continuous learning from incidents, adapting processes, and fostering an agile mindset within the team.

Psychological safety, as defined by Amy C. Edmondson, is the bedrock upon which these HRO principles can effectively function. It creates an environment where team members feel safe to take interpersonal risks – to ask "stupid" questions, admit mistakes, challenge the status quo, or report errors without fear of humiliation or punishment. Sugiura notes that Edmondson’s research showed that higher error reporting in medical teams correlated with better outcomes, precisely because reporting fostered learning. Without psychological safety, errors are hidden, learning stops, and the organization remains vulnerable to repeated incidents.

Sugiura introduces the metaphor of a "C-suite" (referencing a spaceship, not corporate executives) as the ideal model for a CSIRT: a team traveling through unknown territory, operating beyond rigid organizational frameworks, maneuvering freely with external partners, and exercising adaptive leadership like Captain Jean-Luc Picard of the Enterprise. This metaphor underscores the need for agility, collaboration, and empowered decision-making in the face of uncertainty – all facilitated by psychological safety and HRO principles. This dynamic approach, called Teaming, allows individuals to come together flexibly, across traditional departmental boundaries, to address specific tasks or crises, learn from the experience, and then reconfigure as needed.

Ultimately, CSIRTeaming is the synthesis of these "technical" organizational and psychological concepts. It's the operationalization of HRO principles through the lens of psychological safety, enabling a culture where errors are seen as learning opportunities, expertise is valued over hierarchy, and continuous adaptation is the norm. It aims to transform incident response from a reactive, blame-prone activity into a proactive, resilient, and continuously improving function.

Demo / Proof of Concept

▶ Watch: Five Key Leadership Points for CSIRTeaming (21:20)

While Yoshiki Sugiura's talk does not feature a traditional technical demonstration of a tool or a live hack, the entire presentation serves as a conceptual proof of concept for the CSIRTeaming methodology. Rather than showcasing code or system configurations, Sugiura demonstrates the profound impact of psychological safety and HRO principles through compelling anecdotes and real-world observations from his extensive career.

The most poignant "proof of concept" is the story of Herbie Hancock and Miles Davis. Herbie Hancock playing a "wrong chord" during a live performance, fearing his career was over, only to have Miles Davis instantly adapt and reframe it as an "event" rather than a "mistake," perfectly encapsulates the core tenet of treating errors as data for learning rather than reasons for punishment. This anecdote vividly illustrates how deference to expertise (Miles's musical genius) and an inherent psychological safety (Herbie feeling safe enough to later reflect on the incident and share it) allows for resilience and innovation even in high-stakes, real-time environments.

Furthermore, Sugiura shares his own "shocking" experience as a consultant where a CSOC team admitted to "pretending incidents didn't happen" to avoid the heavy administrative burden and executive scrutiny. This real-world example serves as a stark demonstration of the absence of psychological safety and HRO principles. The team, composed of "sincere and diligent professionals," was forced to hide critical information, thereby preventing organizational learning and leaving the enterprise vulnerable. Sugiura's reflection that he should have addressed this from the perspective of HROs and psychological safety highlights how his proposed framework directly addresses and provides solutions for such systemic dysfunctions.

Thus, the "demo" in this context is a series of illustrative stories and observations that highlight both the pitfalls of current incident management practices and the transformative power of adopting CSIRTeaming's human-centric approach. Sugiura's 27 years of experience and research serve as the empirical foundation for his argument, making the entire talk a compelling, if unconventional, proof of concept for the efficacy of psychological safety and HRO principles in building resilient incident response teams.

Defensive Implications

▶ Watch: Call to Action: Reclaiming Trust and Speaking Up (27:40)

The implications of CSIRTeaming for defenders are profound, moving beyond mere technical controls to fundamentally reshape how incident management teams operate and learn. Sugiura outlines five key leadership points that are crucial for cultivating a CSIRTeaming environment grounded in HRO principles and psychological safety:

1. Fostering a Culture of Modeling Vulnerability: Leaders must be willing to say, "I don't know." No single leader can possess all knowledge. When leaders admit their limitations and openly ask for help, it significantly increases psychological safety within the team. This vulnerability prevents information hoarding, encourages open communication, and reduces the likelihood of critical oversights. It sets a precedent that it's okay not to have all the answers, fostering a collaborative problem-solving environment.

1. Blameless Retrospective (ABC Culture): Post-incident analysis should shift from finding fault to fostering learning. Sugiura advocates for an "ABC culture": accusation-free, blame-free, consequence-free. Leaders should start by thanking or praising those who report concerns, no matter how small. The focus should be on "what happened" and "what we can learn," rather than "who messed up." By removing the fear of punishment, teams are encouraged to be honest about mistakes, enabling deeper analysis and genuine continuous improvement (Kaizen).

1. Messenger Boundary Spanning: A leader's role extends beyond internal team management. They must act as strategic messengers, bridging communication gaps between the team and critical stakeholders such as legal, peer teams, and executive management. This involves not just relaying information but leveraging this role to drive meaningful change across organizational boundaries, ensuring that insights from the front lines inform broader strategic decisions and resource allocation.

1. Cognitive Load Management and Debriefing: Security professionals frequently operate under immense pressure, enduring constant tension and long hours, especially during incident response. Leaders have a critical responsibility to monitor their team's cognitive load and mental fatigue. This requires decisive action to enforce rotations, mandatory rest, and breaks, viewing rest as an essential component of the job, not a luxury. Additionally, securing dedicated time for debriefing – which includes emotional care and processing the psychological impact of incidents – is vital for sustaining long-term team resilience and preventing burnout.

1. Situational Humility and Framing: Incident response is inherently an uncertain task with no single "right" answer. Leaders must frame it as such, fostering situational humility. Instead of allowing teams to become overwhelmed by uncertainty ("It's all over. I don't know what to do."), leaders should reframe the situation as "a challenge for our team that we will overcome, no matter what." This positive framing, combined with an acknowledgment of complexity, empowers teams to embrace the challenge and collectively find solutions.

Sugiura concludes by emphasizing that these practices are more than just management techniques; they are about reclaiming the fundamental foundation of trust within organizations. Citing Yuval Noah Harari, he notes that while the global security community often operates with a charitable position and trust, internal corporate structures, focused on monitoring, auditing, and performance, often foster distrust and worst-case interpretations. For defenders, this means actively working to build an internal culture of trust, similar to that shared within the FIRST community, where everyone feels encouraged to speak up. This transformation, Sugiura asserts, doesn't come from new frameworks or tools alone but requires a willingness to change, starting with individual leaders and team members.

Key Takeaways

• Human Element is Paramount: Effective incident management hinges not just on technical prowess or processes, but fundamentally on team dynamics, organizational culture, and psychological safety.
• Embrace High Reliability Organization (HRO) Principles: Adopt the five HRO tenets—preoccupation with failure, reluctance to simplify, sensitivity to operations, deference to expertise, and commitment to resilience—to build robust, adaptive incident response capabilities.
• Cultivate Psychological Safety: Create an environment where team members feel safe to report errors, admit vulnerabilities, and take interpersonal risks without fear of blame or punishment, fostering continuous learning and improvement.
• Leadership is Transformative: Leaders must model vulnerability, practice blameless retrospectives, span organizational boundaries, manage team cognitive load, and frame incidents as challenges to be overcome, driving cultural change from the top down and bottom up.
• Prioritize Trust and Learning: Actively build a culture of trust within the organization, treating errors as valuable data for learning rather than individual failures, to prevent repeated incidents and foster genuine resilience.
• CSIRTeaming for Resilience: Integrate HRO principles and psychological safety into a dynamic "Teaming" approach, allowing flexible collaboration and continuous adaptation across organizational frameworks to build truly resilient incident management teams.

About the Speaker(s)

Yoshiki Sugiura is a distinguished figure in the field of cybersecurity and incident response, currently serving with NTT-CERT, an organization he established in 2004. With a career spanning 27 years in CERT activities, Sugiura began his journey on November 2nd, 1998, joining JPCERT/CC in the same year. His extensive experience is complemented by a deep commitment to the global cybersecurity community, evidenced by his consistent attendance at the FIRST conference since 2000.

Originally a programmer, Sugiura's professional focus has evolved to encompass organizational social psychology and education. This shift led him to extensive research into High Reliability Organizations (HROs) and psychological safety, which now form the core of his insights into building resilient incident management teams. His unique blend of technical background and social science research allows him to address the complex human and cultural dimensions of cybersecurity. Sugiura is also an avid music enthusiast, traveling the world to experience live performances, and draws inspiration from the philosophies of musicians like Robert Fripp and David Byrne, often weaving musical elements into his presentations.