Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/2/2017
10:00 AM
Tom Webb
Tom Webb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

How to Succeed at Incident Response Metrics

Establishing a baseline of what information you need is an essential first step.

Collecting metrics for your incident response team is as critical as training your team. Without metrics, it is nearly impossible to determine how effective your team is, if your technology investments are performing as expected, and how satisfied management is with the current results. The hardest part is getting started, but it’s the beginning of really great data analytics.

Establish a baseline of what information you need to answer the questions that are most important to your team. Below are the most basic metrics all teams should keep, but you may have others you want to track to help with making a business case for control.

  • Time from compromise to discovery (dwell time)
  • Time from alarm to triage
  • Time to close
  • Incident classification
  • Detection method

When determining how to classify your incident into categories, it is best to use an already developed taxonomy instead of creating your own. By doing this, you will be able to easily compare yourself with peers and published reports. The VERIS framework is one of the more popular choices, and the Verizon Data Breach Investigations Report uses this framework, which allows you to compare yourself to this report yearly. Here is a great list of the most common taxonomies. Another thing to consider when choosing a taxonomy is if your peers in your industry have a preferred choice.

This can be tricky because your initial choice might be to expand your current tracking to facilitate this new data. If you are already using a tool like Request Tracker Incident Response, by creating custom fields, you can track these data points. And for the basic data points, this works fine. Most people seem to run into issues when they start trying to collect most, if not all, of a complex taxonomy. Depending on how flexible your tools are and how complex making these changes would be, it might make more sense to use a survey type of tool for entering and mining just the metadata of your incidents and keep your case note in your current tracking system.

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Once this data is available, you can start measuring how changes affect your environment. It is important to track when processes change, new tools are implemented, what personal changes happen, etc. All of these things will make the number fluctuate. You should expect an additional junior staff hire to lengthen time-to-close initially, but you should see your dwell time shorten because you have more people looking for incidents. Some of the more useful questions I try to answer with the data are below.

  • What is your average/median time for detection?
  • How much time are you saving by implementing the new process?
  • What types of incidents are taking the longest? Do you need more training or better tools?

Having this baseline in place for the past few years has helped me draw some very useful conclusions. If management isn't satisfied with how quickly you are finding incidents, you should have numbers to support your recommendations to address the issues. If you spent $500,000 on a new tool but it only leads to detecting 20 incidents, is this something you should continue to support? This data has been very powerful for my team in making lots of business cases for change, and without it, I believe we would not be nearly as effective or efficient.

Note: Tom Webb will be giving a talk on this topic at an upcoming SANS event in Washington, D.C., in July.

Related Content:

Tom Webb is an incident handler for the SANS Internet Storm Center. He currently leads a team of six that perform incident response and forensics investigations and vulnerability management. He has 12 years dedicated to security. Tom holds several certs, including the GSE and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/6/2017 | 7:56:12 AM
Very Helpful
Thank you for creating this article. I have been tasked with performing these functions at my current employer so this really hits home for me.
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
CVE-2019-9700
PUBLISHED: 2019-07-16
Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVE-2019-12990
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
CVE-2019-12991
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).