Dispatch: Crisis Management Automation for the Entire Organization
Channel: FIRST
Date: 2021-06-17

Speakers: Marc Vilanova (Netflix, US), Kevin Glisson (Netflix, US)

Elevator Pitch
We built Dispatch to automate our entire crisis management lifecycle, from initial report, to resource creation, participant assembly, task tracking and post-incident reviews. We want you to use it someday too, so we’ll explain how it helps us, and why you should check it out.

Abstract
The first few minutes of a crisis can be extremely stressful. A responder faces many initial questions: What is the scope of the incident? The severity? Who is impacted? Who needs to be engaged to help resolve the issue? How will they work together?

As members of Netflix's Security Incident Response Team (SIRT), we are an escalation point for internal teams. Our team is responsible for responding to security incidents across the entire organization. We face the above questions on a daily basis. To help, we built tooling that allows us to augment our abilities. We programmatically create collaboration resources, provide context, and orient new participants, engaging and informing the right people in seconds instead of minutes -- or even hours. As a result, we can quickly get to work on resolving the incident faster, rather than spending time creating and sharing chat channels, spreadsheets, e-mail, and documents.

This talk will provide an overview of our crisis management automation tool, Dispatch. We use Dispatch to manage the entire crisis management lifecycle, from the initial report to resource creation, participant assembly, investigation & remediation task tracking, and post-incident reviews. We envision Dispatch becoming a crisis management framework that others could use to resolve incidents.

About the Speakers
Marc Vilanova is a Senior Security Engineer at Netflix where he helps drive security incidents to resolution, and design and develop automation for crisis management and digital forensics. Marc previously worked for Facebook as a Security Engineer where he focused on building automation for online investigations and attribution, and investigating and enforcing against high impact threats.

Kevin is a Senior Security Engineer at Netflix who has previously conquered SSL/TLS Automation (Lemur) and Distributed application security scanning (Monterey). Previously working as a Cyber Intelligence Analyst and Computer Security Incident Responder for JPMorgan Chase & Co. He is deeply interested in all things related to security automation including infrastructure security, intelligence gathering, and forensic data collection. In his free time, he is an avid mountain biker, ultimate frisbee player, and new dad.