Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


End of Bibblio RCM includes -->
06:20 PM
Connect Directly

Despite Heightened Breach Fears, Incident Response Capabilities Lag

Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.

A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.

Related Content:

How to Create an Incident Response Plan From the Ground Up

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: Cybersecurity: What Is Truly Essential?

Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.

The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.

"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke is unable to determine which specific trees are on fire.

The data in Wakefield's survey suggests that many organizations are still struggling with familiar, old challenges not just with IR but with other broader information security issues as well. Though a lot has been made about a substantial increase in attack volumes, the growing sophistication of threats, and concerns over SolarWinds-like attacks, enterprise responses appear to be lagging.

Nearly one in two (49%) organizations, for instance, still lack adequate tools, staffing, and expertise to detect or respond to threats. Forty percent have no processes for ensuring third-party compliance with required security controls despite the broadly acknowledged risks that third parties and supply chain partners present to enterprises. Though human error remains one of the primary causes for data breaches, 37% don’t have any employee awareness program.

Troublingly, though, breaches can often trigger major regulatory and legal consequences: Nearly half (47%) of the security leaders in the survey said their IR teams were unsure about when to engage legal counsel. Forty percent described the security group as ill-equipped to deal with all the legal requirements associated with a breach, such as preserving evidence for potential litigation. Organizations in the survey reported a similar lack of preparedness for dealing with breach communication and notification requirements.

"When the 'fog of war' hits, post-incident, it's a bad time to start thinking about a response plan," Oviatt says. Security groups and IR teams need to have already done some of the work ahead of an incident and made sure they understand legal implications, including potential for future legal action.

"If customer data is lost, the company may need to defend itself. If the loss was due to an employee action, the company may need to pursue legal action," Oviatt notes. "Ensuring that both technology and all related processes are in place ahead of time is simply good business management.”

The survey reveals substantial concern among security leaders about data breaches. More than half of the respondents admitted to being more concerned about ransomware attacks, decreased endpoint visibility, and attacks targeting remote desktops and VPN systems.

The general apprehension over breaches and inadequate IR plans appears to have driven many organizations to third-party managed detection and response (MDR) providers. Seventy-six percent presently have engaged a third-party provider for at least some of their detection and response needs. Security leaders perceive MDR providers as helping organizations detect, respond to, and contain breaches faster than they can on their own.

"Third-party firms have seen many more incidents than any one customer has experienced, so they have both well-defined playbooks and people who know how to handle each step well," Oviatt says.

At the same time, an internal team is critical to ensuring that the third-party service provider has the necessary context — such as what constitutes normal activity on the network or the meaning of employee roles — when dealing with an incident, he says.

"Simply put, security is less like a house fire, where the best route is for the owners to get out and let the firefighters handle everything," Oviatt says. "[It's] more like a tax audit, where the professional and the customer work together to ensure that all the right actions are taken."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file