Blog Contact Us Log In
SOC-as-a-Service
SOC-as-a-Service Overview
Cloud Infrastructure Security
ActiveEye Platform
Security Services Overview
Cloud Security Professional Services
Pen Testing & Assessments
Cyber Threat Hunting
Cyber Security Exercises
Compliance & Strategy
CISO Guidebook
Legal Sector
About Delta Risk
Incident Response Strategy: Determining Where to Invest
February 15, 2018 | by Andrew Cook
It can be hard to plan for a security incident if you've never experienced one first hand. Incidents involve unauthorized access, denial of service, presence of malicious logic, and improper usage. As an incident responder, I've seen plenty of these situations play out.
I was fortunate to share some of my experiences and lessons with the top-notch professionals attending the LegalCIO conference in New York, where we hosted a round table covering "Is Your Organization Prepared for a Cyber Attack? Key Takeaways from Real-Life Incidents." The discussion focused on lessons learned from real-world scenarios, and whether the attendees were truly prepared for a cyber-attack.
This conversation led participants to start talking about how effectively they were allocating their security budgets, and whether those investments would pay off during an incident.
How Do You Know You're Investing in the Right Security Measures?
If you're making investments in cyber security, your organization has the foresight and initiative to protect your most critical assets. That's the good news. Unfortunately, knowing where to direct those funds so you're investing in the most effective security tools and processes can be a challenge all on its own. Making poor investment choices can leave you vulnerable and can lull you into a state-of-mind that everything is going great when it's not.
First, make sure you're devoting those cyber security dollars to the areas of highest business risk. This means reviewing how your business depends on your network, systems, and cloud environments.
Next, determine which cyber-related threats could endanger those systems. You'll need to go through some "what-if" nightmare scenarios and ensure that you have the capabilities in place to prevent, detect, and respond to those threats. What does an incident involving that system or data look like, and are you equipped to handle it?
Lastly, like any other business goal, your investment should cover three areas of focus: people, process, and technology. Assess your organization's security program across these dimensions and invest in areas where you're weakest.
Among organizations with any security investment at all, I commonly see heavy investments in technologies that are being poorly implemented because of lack of trained people that don't have any good processes.
How Do You Know You're Getting What You Expected from the Investment?
Continually assess the capabilities of your security team to make sure that you're getting what. It is especially dangerous to assume that the recurring fee you're paying to some IT or MSSP vendor covers all your cyber security needs.
I've seen too many instances where a vendor claimed to provide "security monitoring" and yet they could not provide something as simple as firewall or authentication logs during an incident. I've also seen places where the IT administrator was expected to deal with incident response tasks they were ill-equipped to perform.
Whether your cyber security team is internal or outsourced, this much is the same: assess, assess, assess! There's a dizzying array of options: penetration tests, vulnerability assessments, audits, compromise assessments, functional exercises, table-top exercises, but they all serve a purpose, and can all be tweaked for exactly what you're trying to evaluate.
For example, if you're concerned that your security provider won't measure up when you have an incident, then conduct a "silent" penetration test. Have a red team safely generate the incident scenario that you're concerned about.
Your security team may or may not detect the incident, but that's not the whole story — even the best defenders can be blind to a good offensive team. Instead of stopping there, keep the scenario going and see if they're able to give you the answers and support you expect when things start getting chaotic.
If you'd like to get more tips on incident response best practices, tune in to our on-demand webinar, "Data Breach Survival Tactics: Building Actionable Incident Response Plans."
Categories: Incident Response | Tagged: incident response, incident response planning, incident response strategy
2018 Cyber Security Trends: Where are We Headed This Year?
Webinar Q&A: Delta Risk Experts Share Tips for Improving Incident Response Plans
New ActiveEye Features Speed Threat Response, Improve Productivity September 10, 2020
5 Tips for Kickstarting Your Cyber Security Program August 28, 2020
4 Cyber Incident Scenarios You Should Exercise and Test August 20, 2020
How to Deal with Ransomware in 2020 August 14, 2020
Our Best Cyber Security Blogs of 2020: Mid-Year Update July 29, 2020
Cyber Security Hiring
Cyber Security Strategy
Cyber Security Threats
Employee Training and Awareness
G Suite Security
106 S. St. Mary's Street
Company and Resources
© 2021 Delta Risk | All Rights Reserved
Privacy Policy | Equal Opportunity/Affirmative Action Employer | Sitemap | Contact