Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


End of Bibblio RCM includes -->
06:20 PM
Connect Directly

Despite Heightened Breach Fears, Incident Response Capabilities Lag

Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.

A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.

Related Content:

How to Create an Incident Response Plan From the Ground Up

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: Cybersecurity: What Is Truly Essential?

Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.

The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.

"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke is unable to determine which specific trees are on fire.

The data in Wakefield's survey suggests that many organizations are still struggling with familiar, old challenges not just with IR but with other broader information security issues as well. Though a lot has been made about a substantial increase in attack volumes, the growing sophistication of threats, and concerns over SolarWinds-like attacks, enterprise responses appear to be lagging.

Nearly one in two (49%) organizations, for instance, still lack adequate tools, staffing, and expertise to detect or respond to threats. Forty percent have no processes for ensuring third-party compliance with required security controls despite the broadly acknowledged risks that third parties and supply chain partners present to enterprises. Though human error remains one of the primary causes for data breaches, 37% don’t have any employee awareness program.

Troublingly, though, breaches can often trigger major regulatory and legal consequences: Nearly half (47%) of the security leaders in the survey said their IR teams were unsure about when to engage legal counsel. Forty percent described the security group as ill-equipped to deal with all the legal requirements associated with a breach, such as preserving evidence for potential litigation. Organizations in the survey reported a similar lack of preparedness for dealing with breach communication and notification requirements.

"When the 'fog of war' hits, post-incident, it's a bad time to start thinking about a response plan," Oviatt says. Security groups and IR teams need to have already done some of the work ahead of an incident and made sure they understand legal implications, including potential for future legal action.

"If customer data is lost, the company may need to defend itself. If the loss was due to an employee action, the company may need to pursue legal action," Oviatt notes. "Ensuring that both technology and all related processes are in place ahead of time is simply good business management.”

The survey reveals substantial concern among security leaders about data breaches. More than half of the respondents admitted to being more concerned about ransomware attacks, decreased endpoint visibility, and attacks targeting remote desktops and VPN systems.

The general apprehension over breaches and inadequate IR plans appears to have driven many organizations to third-party managed detection and response (MDR) providers. Seventy-six percent presently have engaged a third-party provider for at least some of their detection and response needs. Security leaders perceive MDR providers as helping organizations detect, respond to, and contain breaches faster than they can on their own.

"Third-party firms have seen many more incidents than any one customer has experienced, so they have both well-defined playbooks and people who know how to handle each step well," Oviatt says.

At the same time, an internal team is critical to ensuring that the third-party service provider has the necessary context — such as what constitutes normal activity on the network or the meaning of employee roles — when dealing with an incident, he says.

"Simply put, security is less like a house fire, where the best route is for the owners to get out and let the firefighters handle everything," Oviatt says. "[It's] more like a tax audit, where the professional and the customer work together to ensure that all the right actions are taken."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-12-01
A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login.
PUBLISHED: 2022-11-30
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched ...
PUBLISHED: 2022-11-30
Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected con...
PUBLISHED: 2022-11-30
The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token use...
PUBLISHED: 2022-11-30
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.