Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/2/2017
10:00 AM
Tom Webb
Tom Webb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

How to Succeed at Incident Response Metrics

Establishing a baseline of what information you need is an essential first step.

Collecting metrics for your incident response team is as critical as training your team. Without metrics, it is nearly impossible to determine how effective your team is, if your technology investments are performing as expected, and how satisfied management is with the current results. The hardest part is getting started, but it’s the beginning of really great data analytics.

Establish a baseline of what information you need to answer the questions that are most important to your team. Below are the most basic metrics all teams should keep, but you may have others you want to track to help with making a business case for control.

  • Time from compromise to discovery (dwell time)
  • Time from alarm to triage
  • Time to close
  • Incident classification
  • Detection method

When determining how to classify your incident into categories, it is best to use an already developed taxonomy instead of creating your own. By doing this, you will be able to easily compare yourself with peers and published reports. The VERIS framework is one of the more popular choices, and the Verizon Data Breach Investigations Report uses this framework, which allows you to compare yourself to this report yearly. Here is a great list of the most common taxonomies. Another thing to consider when choosing a taxonomy is if your peers in your industry have a preferred choice.

This can be tricky because your initial choice might be to expand your current tracking to facilitate this new data. If you are already using a tool like Request Tracker Incident Response, by creating custom fields, you can track these data points. And for the basic data points, this works fine. Most people seem to run into issues when they start trying to collect most, if not all, of a complex taxonomy. Depending on how flexible your tools are and how complex making these changes would be, it might make more sense to use a survey type of tool for entering and mining just the metadata of your incidents and keep your case note in your current tracking system.

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Once this data is available, you can start measuring how changes affect your environment. It is important to track when processes change, new tools are implemented, what personal changes happen, etc. All of these things will make the number fluctuate. You should expect an additional junior staff hire to lengthen time-to-close initially, but you should see your dwell time shorten because you have more people looking for incidents. Some of the more useful questions I try to answer with the data are below.

  • What is your average/median time for detection?
  • How much time are you saving by implementing the new process?
  • What types of incidents are taking the longest? Do you need more training or better tools?

Having this baseline in place for the past few years has helped me draw some very useful conclusions. If management isn't satisfied with how quickly you are finding incidents, you should have numbers to support your recommendations to address the issues. If you spent $500,000 on a new tool but it only leads to detecting 20 incidents, is this something you should continue to support? This data has been very powerful for my team in making lots of business cases for change, and without it, I believe we would not be nearly as effective or efficient.

Note: Tom Webb will be giving a talk on this topic at an upcoming SANS event in Washington, D.C., in July.

Related Content:

Tom Webb is an incident handler for the SANS Internet Storm Center. He currently leads a team of six that perform incident response and forensics investigations and vulnerability management. He has 12 years dedicated to security. Tom holds several certs, including the GSE and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/6/2017 | 7:56:12 AM
Very Helpful
Thank you for creating this article. I have been tasked with performing these functions at my current employer so this really hits home for me.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.