Situation normal: All fouled up

The DevOps community is becoming increasingly aware that incident response is a “thing.” Rare major events (e.g., recent airline outages, the NYSE downtime, and the collapse of Healthcare.gov) get lots of attention, but IT insiders encounter incidents much more often—sometimes on a daily basis. Incident response includes multiple, overlapping activities and incurs substantial costs, including the effort needed to coordinate and sustain work on recovery, analysis, and review as well as internal and external communications. The SNAFUcatchers Consortium is studying these interwoven activities and characterizing the resources—human and technical—that make incident response work. Richard Cook and David Woods offer a 10,668-meter view of the project and explain what they expect to find.