theDocumentId => 1341000 Despite Heightened Breach Fears, Incident Response ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/12/2021
06:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Despite Heightened Breach Fears, Incident Response Capabilities Lag

Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.

A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.

Related Content:

How to Create an Incident Response Plan From the Ground Up

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: Cybersecurity: What Is Truly Essential?

Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.

The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.

"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke is unable to determine which specific trees are on fire.

The data in Wakefield's survey suggests that many organizations are still struggling with familiar, old challenges not just with IR but with other broader information security issues as well. Though a lot has been made about a substantial increase in attack volumes, the growing sophistication of threats, and concerns over SolarWinds-like attacks, enterprise responses appear to be lagging.

Nearly one in two (49%) organizations, for instance, still lack adequate tools, staffing, and expertise to detect or respond to threats. Forty percent have no processes for ensuring third-party compliance with required security controls despite the broadly acknowledged risks that third parties and supply chain partners present to enterprises. Though human error remains one of the primary causes for data breaches, 37% don’t have any employee awareness program.

Troublingly, though, breaches can often trigger major regulatory and legal consequences: Nearly half (47%) of the security leaders in the survey said their IR teams were unsure about when to engage legal counsel. Forty percent described the security group as ill-equipped to deal with all the legal requirements associated with a breach, such as preserving evidence for potential litigation. Organizations in the survey reported a similar lack of preparedness for dealing with breach communication and notification requirements.

"When the 'fog of war' hits, post-incident, it's a bad time to start thinking about a response plan," Oviatt says. Security groups and IR teams need to have already done some of the work ahead of an incident and made sure they understand legal implications, including potential for future legal action.

"If customer data is lost, the company may need to defend itself. If the loss was due to an employee action, the company may need to pursue legal action," Oviatt notes. "Ensuring that both technology and all related processes are in place ahead of time is simply good business management.”

The survey reveals substantial concern among security leaders about data breaches. More than half of the respondents admitted to being more concerned about ransomware attacks, decreased endpoint visibility, and attacks targeting remote desktops and VPN systems.

The general apprehension over breaches and inadequate IR plans appears to have driven many organizations to third-party managed detection and response (MDR) providers. Seventy-six percent presently have engaged a third-party provider for at least some of their detection and response needs. Security leaders perceive MDR providers as helping organizations detect, respond to, and contain breaches faster than they can on their own.

"Third-party firms have seen many more incidents than any one customer has experienced, so they have both well-defined playbooks and people who know how to handle each step well," Oviatt says.

At the same time, an internal team is critical to ensuring that the third-party service provider has the necessary context — such as what constitutes normal activity on the network or the meaning of employee roles — when dealing with an incident, he says.

"Simply put, security is less like a house fire, where the best route is for the owners to get out and let the firefighters handle everything," Oviatt says. "[It's] more like a tax audit, where the professional and the customer work together to ensure that all the right actions are taken."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32686
PUBLISHED: 2021-07-23
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and ...
CVE-2021-32783
PUBLISHED: 2021-07-23
Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy rem...
CVE-2021-3169
PUBLISHED: 2021-07-23
An issue in Jumpserver 2.6.2 and below allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
CVE-2020-20741
PUBLISHED: 2021-07-23
Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if t...
CVE-2021-25808
PUBLISHED: 2021-07-23
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.