During a cybersecurity incident interview, a witness becomes defensive when asked about their access logs. Which technique is most appropriate to re-establish rapport?
-
A
Increase the intensity of questioning to break resistance
-
B
Use an empathic statement acknowledging their concerns before continuing
-
C
Immediately escalate to a formal interrogation format
-
D
Document the defensiveness and end the interview