One of the underappreciated aspects of incident response (IR) is that it often starts as a data problem. In many cases, IR teams are presented with an effect such as malware or adversary activity and charged with determining the cause through the identification of evidence that ties the cause and effect together within an environment that they have no visibility or context. This situation creates the “IR data problem” wherein responders must first collect and curate large amounts of data before they are able to provide impactful results that can aid in containment and eradication of the incident.

Endpoint detection and response (EDR) technology is often used during incident response engagements and the EDR market has made incredible advances in detection technology however EDR solutions are only good from the moment they are installed on a system going forward. Unless the EDR technology was installed throughout the entire incident and it retains all of the telemetry gathered throughout the entire attack lifecycle, responders are still faced with a giant data problem.

Historically, IR teams solved the data problem by deploying custom tools or scripts to all systems within the enterprise and pulling the results back to a separate platform. While classic data collection mechanisms can be effective at building the narrative of an incident through the identification of evidence, it does introduce additional workstreams that draw resources away from analysis.

True incident response technology needs to understand the fundamental flows of modern incident response to add tactical automation to solve the IR data problem. Tactical automation understands that the responder is the most crucial component of effective incident response and adds automation to the right places to enhance rather than replace the responder.

More on Incident Response

Built by Responders, for Responders

Approaching a solution for the data problem of IR requires designing a platform that is built from the  IR practitioner’s point of view. By approaching the problem from the responder’s point of view, an opportunity arises to create a unique rubric for measuring improvements in incident response by identifying high-impact opportunities within the IR lifecycle.

Time to contain and time to remediate have historically been a key performance metric used to evaluate incident response however from a responder’s point of view measuring speed is more nuanced. While time and speed are obviously important to IR, measuring impact in terms of time appears to be a more appropriate metric to measure improvements and success of incident response. If a response is able to decrease the overall impact to an organization by shortening the time to gathering impactful findings, the time to contain and time to remediate metrics will naturally improve. Furthermore, tactical automation could shorten the time to impactful findings by reducing the amount of time spent by responders collecting and processing data and increase the amount of time responders are analyzing data.

With these incident response metrics in mind, a true incident response platform can be characterized by:

  • Automate initial collection/investigation analysis to drive response actions immediately
  • Flexible and parallelized processes that allow human investigators to maximize the use of their time

In practice, the IR platform enables responders to push the value of the IR service to a more immediate and impactful part of the IR lifecycle.

Cybersecurity has become a massive industry however continued investment solely in prevention is not enough. All of the evidence shows that incidents are going to continue to happen so organizations must prepare for the worst-case scenarios and consider effective incident response a core component to their overall security strategy.

Solving the Incident Response Data Problem

Join Cybereason Senior Director of Incident Response Engineering Jim Hung, and IBM Security X-Force Head of Research John Dwyer (@TactiKoolSec) as they discuss how a design partnership between  X-Force and Cybereason created a new platform to deliver a faster, more efficient approach to IR.

Watch on Demand

More from Incident Response

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Expert Insights on the X-Force Threat Intelligence Index

5 min read - Top insights are in from this year’s IBM Security X-Force Threat Intelligence Index, but what do they mean? Three IBM Security X-Force experts share their thoughts on the implications of the most pressing cybersecurity threats, and offer guidance for what organizations can do to better protect themselves. Moving Left of Boom: Early Backdoor Detection Andy Piazza, Global Head of Threat Intelligence at IBM Security X-Force, sat down with Security Intelligence to chat with us about the rise in the deployment…

5 min read

How Morris Worm Command and Control Changed Cybersecurity

4 min read - A successful cyberattack requires more than just gaining entry into a victim’s network. To truly reap the rewards, attackers must maintain a persistent presence within the system. After establishing communication with other compromised network devices, actors can stealthily extract valuable data. The key to all this is a well-developed Command and Control (C2 or C&C) infrastructure. The number of C2 servers used for launching cyberattacks increased by 30% in 2022. More than 17,000 of these servers were detected last year,…

4 min read