Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


End of Bibblio RCM includes -->
06:20 PM
Connect Directly

Despite Heightened Breach Fears, Incident Response Capabilities Lag

Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.

A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.

Related Content:

How to Create an Incident Response Plan From the Ground Up

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: Cybersecurity: What Is Truly Essential?

Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.

The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.

"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke is unable to determine which specific trees are on fire.

The data in Wakefield's survey suggests that many organizations are still struggling with familiar, old challenges not just with IR but with other broader information security issues as well. Though a lot has been made about a substantial increase in attack volumes, the growing sophistication of threats, and concerns over SolarWinds-like attacks, enterprise responses appear to be lagging.

Nearly one in two (49%) organizations, for instance, still lack adequate tools, staffing, and expertise to detect or respond to threats. Forty percent have no processes for ensuring third-party compliance with required security controls despite the broadly acknowledged risks that third parties and supply chain partners present to enterprises. Though human error remains one of the primary causes for data breaches, 37% don’t have any employee awareness program.

Troublingly, though, breaches can often trigger major regulatory and legal consequences: Nearly half (47%) of the security leaders in the survey said their IR teams were unsure about when to engage legal counsel. Forty percent described the security group as ill-equipped to deal with all the legal requirements associated with a breach, such as preserving evidence for potential litigation. Organizations in the survey reported a similar lack of preparedness for dealing with breach communication and notification requirements.

"When the 'fog of war' hits, post-incident, it's a bad time to start thinking about a response plan," Oviatt says. Security groups and IR teams need to have already done some of the work ahead of an incident and made sure they understand legal implications, including potential for future legal action.

"If customer data is lost, the company may need to defend itself. If the loss was due to an employee action, the company may need to pursue legal action," Oviatt notes. "Ensuring that both technology and all related processes are in place ahead of time is simply good business management.”

The survey reveals substantial concern among security leaders about data breaches. More than half of the respondents admitted to being more concerned about ransomware attacks, decreased endpoint visibility, and attacks targeting remote desktops and VPN systems.

The general apprehension over breaches and inadequate IR plans appears to have driven many organizations to third-party managed detection and response (MDR) providers. Seventy-six percent presently have engaged a third-party provider for at least some of their detection and response needs. Security leaders perceive MDR providers as helping organizations detect, respond to, and contain breaches faster than they can on their own.

"Third-party firms have seen many more incidents than any one customer has experienced, so they have both well-defined playbooks and people who know how to handle each step well," Oviatt says.

At the same time, an internal team is critical to ensuring that the third-party service provider has the necessary context — such as what constitutes normal activity on the network or the meaning of employee roles — when dealing with an incident, he says.

"Simply put, security is less like a house fire, where the best route is for the owners to get out and let the firefighters handle everything," Oviatt says. "[It's] more like a tax audit, where the professional and the customer work together to ensure that all the right actions are taken."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-02-04
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition ...
PUBLISHED: 2023-02-04
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling Ap...
PUBLISHED: 2023-02-04
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.