Here’s An Opinion On:
Detection: What You Don’t Know Will Hurt You
by
Mir Ariif
Detection, the second of the three keys to effective cybersecurity, is essential to identifying existing weaknesses and breaches and having them resolved.
One of the realities of today’s cybersecurity threatscape is not if you will be breached, but when, and how often. As good as cybersecurity is becoming – i.e. prevention solutions provide a 99.9 percent or higher detection rate for common malware – effective cybersecurity depends upon three pillars – prevention, detection and resolution – with the latter two required to address those situations where prevention isn’t enough.
In the majority (93 percent) of cyber breaches – over 740 million in 2015, and 340 million in the first half of 2016 – attackers take minutes or less to compromise systems and data exfiltration occurs within minutes in close to a third (28 percent) of the cases. Even more worrisome, the mean time to identify (MTTI) a data breach was 201 days, and a mean time to contain (MTTC) was 70 days.
Unfortunately, MTTI and MTTC scores aren’t the only areas where detection gets a failing grade. Up to 70 percent of data breaches are detected by third parties rather than by organizations’ own security operations teams, possibly because they are detecting too much.
Organizations are seeing and evaluating tens or hundreds of thousands of alerts daily. On average, 29 percent of all malware alerts received are investigated and an average of 40 percent are considered false positives.
Still, with the average total cost of a data breach up to $4 million – the average cost paid for each lost or stolen record containing sensitive and confidential information increased from $154 in 2015 to $158 in 2016 – timely detection is critical to business success, if not business survival.
Given the high costs of data breaches and stolen or lost records, it’s no surprise that detection is getting a lot more attention. By 2020, 60 percent of enterprise information security budgets will be allocated for rapid detection and response approaches, up from less than 20 percent in 2015.
Prevention does the heavy lifting when it comes to effective cybersecurity, but detection is essential for identifying the small but incredibly dangerous few that breach the perimeter. It is this vital second pillar that enables their removal and resolution of any issues resulting from that breach or other cyberthreat, as we’ll examine in part three.
5 steps to rapid detection and response
Comprised of five steps designed in a feedback loop, the Rapid Detection and Response Model helps organizations accelerate their ability to detect, investigate and stop attacks.
Step 1: Identify
Purpose: Create situational awareness of the organization’s threat environment by identifying technology and process gaps that lead to blind spots.
Activities:
Document existing security infrastructure
Analyze capabilities of security technologies
Examine operational processes
Review detection and response metrics
Evaluate the threat landscape
Step 2: Prepare
Purpose: Close gaps that hinder the ability to efficiently detect, respond to and resolve incidents.
Activities:
Implement technology
Integrate systems
Modify processes
Perform tabletop exercises to train personnel
Step 3: Detect
Purpose: Identify security incidents
Activities:
Monitor and apply threat intelligence to endpoints, network traffic and log files to validate alerts
Perform security analytics to uncover suspicious anomalies
Step 4: Respond
Purpose: Confirm and investigate security incidents to understand what occurred and assess the impact.
Activities:
Contain affected systems
Collect and analyze data to classify the threat
Dissect the attack path, reconstruct what it did
Document the attack details
Step 5: Resolve
Purpose: Create and implement a remediation plan to remove all points of entry available to the threat.
Activities:
Remove back doors
Fix exploited vulnerabilities
Reset compromised user credentials
Restore services
Document and apply lessons learned to bolster preventative defenses and improve ongoing rapid detection and response
About us:
We provides technical support service to protect your PC from potential online threats and external attacks like viruses, Trojans, malwares, spywares and phishing scams. for more information link on Avast help and support
We provides technical support service to protect your PC from potential online threats and external attacks like viruses, Trojans, malwares, spywares and phishing scams. for more information link on
Avast help and support
Article Source:
eArticlesOnline.com
}