3 min read
One of the underappreciated aspects of incident response (IR) is that it often starts as a data problem. In many cases, IR teams are presented with an effect such as malware or adversary activity and charged with determining the cause through the identification of evidence that ties the cause and effect together within an environment that they have no visibility or context. This situation creates the “IR data problem” wherein responders must first collect and curate large amounts of data before they are able to provide impactful results that can aid in containment and eradication of the incident.
Endpoint detection and response (EDR) technology is often used during incident response engagements and the EDR market has made incredible advances in detection technology however EDR solutions are only good from the moment they are installed on a system going forward. Unless the EDR technology was installed throughout the entire incident and it retains all of the telemetry gathered throughout the entire attack lifecycle, responders are still faced with a giant data problem.
Historically, IR teams solved the data problem by deploying custom tools or scripts to all systems within the enterprise and pulling the results back to a separate platform. While classic data collection mechanisms can be effective at building the narrative of an incident through the identification of evidence, it does introduce additional workstreams that draw resources away from analysis.
True incident response technology needs to understand the fundamental flows of modern incident response to add tactical automation to solve the IR data problem. Tactical automation understands that the responder is the most crucial component of effective incident response and adds automation to the right places to enhance rather than replace the responder.
Approaching a solution for the data problem of IR requires designing a platform that is built from the IR practitioner’s point of view. By approaching the problem from the responder’s point of view, an opportunity arises to create a unique rubric for measuring improvements in incident response by identifying high-impact opportunities within the IR lifecycle.
Time to contain and time to remediate have historically been a key performance metric used to evaluate incident response however from a responder’s point of view measuring speed is more nuanced. While time and speed are obviously important to IR, measuring impact in terms of time appears to be a more appropriate metric to measure improvements and success of incident response. If a response is able to decrease the overall impact to an organization by shortening the time to gathering impactful findings, the time to contain and time to remediate metrics will naturally improve. Furthermore, tactical automation could shorten the time to impactful findings by reducing the amount of time spent by responders collecting and processing data and increase the amount of time responders are analyzing data.
With these incident response metrics in mind, a true incident response platform can be characterized by:
In practice, the IR platform enables responders to push the value of the IR service to a more immediate and impactful part of the IR lifecycle.
Cybersecurity has become a massive industry however continued investment solely in prevention is not enough. All of the evidence shows that incidents are going to continue to happen so organizations must prepare for the worst-case scenarios and consider effective incident response a core component to their overall security strategy.
Industry newsletter
Stay up to date on the most important—and intriguing—industry trends on AI, automation, data and beyond with the Think newsletter. See the IBM Privacy Statement.
Your subscription will be delivered in English. You will find an unsubscribe link in every newsletter. You can manage your subscriptions or unsubscribe here. Refer to our IBM Privacy Statement for more information.
Join Cybereason Senior Director of Incident Response Engineering Jim Hung, and IBM Security X-Force Head of Research John Dwyer as they discuss how a design partnership between X-Force and Cybereason created a new platform to deliver a faster, more efficient approach to IR.
IBM web domains
ibm.com, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net, mobilebusinessinsights.com, promontory.com, proveit.com, ptech.org, s81c.com, securityintelligence.com, skillsbuild.org, softlayer.com, storagecommunity.org, think-exchange.com, thoughtsoncloud.com, alphaevents.webcasts.com, ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net, ibmcloud.com, galasa.dev, blueworkslive.com, swiss-quantum.ch, blueworkslive.com, cloudant.com, ibm.ie, ibm.fr, ibm.com.br, ibm.co, ibm.ca, community.watsonanalytics.com, datapower.com, skills.yourlearning.ibm.com, bluewolf.com, carbondesignsystem.com, openliberty.io