Incident Response

Abstract

Are you prepared to manage a security incident? We all love the Sunday papers – until they report the latest high profile breach and we find ourselves answering that Monday morning question, " how would we deal with this type of incident? " Incidents are increasing in frequency which means businesses are spending more time and money on remediation – often working in the eye of a corporate storm to resolve issues at the same time as trying to maintain business as usual. Complex threats such as APT, are difficult and time consuming to unpick and may require specialist knowledge and resources to comprehensively resolve. They also exploit the siloed nature of traditional incident response, that does not necessarily understand the interdependencies in business systems and applications. The maturity of incident response varies considerably, but high performing businesses treat information security breaches as part of their Business Continuity planning. They confidently manage incidents in an efficient, low noise, repeatable manner. A mature approach not only minimizes the impact of a breach on a business and protects valuable data throughout, but also intelligently adapts to prevent further incidents. So how can you drive the maturity of your incident response? Not all incidents are equal To confidently answer the question about how you would respond to an incident, you have to establish a comprehensive, real-time view of network activity. This is the only way to quickly recognize that you are under attack – and dependent on the type of incident – you can then implement a clear plan for the right remedial action for your business. This means that you must be able to classify the incident. Context is important here, as not all incidents are of equal impact – which is why your incident response must be designed with your business goals and compliance requirements front and center. The right intelligence about the impact of any incident will drive a proportionate response and focus resources to minimize damage and disruption, returning to business as usual as quickly and smoothly as possible. Good incident response therefore starts with good risk insight and understanding of your information assets. But mature incident response does not necessarily mean spending more on technology. Most organizations that we talk to have all the technology they need in place, such as data loss prevention, perimeter defenses and log management. What they often ask us to help with is …