Why the prioritisation of breach identification and containment are crucial elements of every cyber defence strategy

One of the most significant elements of the current cyber threat landscape is the amount of time it takes to actually detect and contain a breach. In a study published last year by IBM security and the Ponemon Institute, the Mean Time to Identify (MTTI) and Mean Time to Contain (MTTC) metrics were used to assess the effectiveness of an organisation’s incident response and containment processes. The research found that it took an average of 168 days to identify a data breach and 67 days to contain it.

The key problem is that in today’s climate few attacks are aimed solely on an organisation’s external defences. This is because, with data security legislation at the strongest it has ever been, external defences like firewalls and network security are usually reasonably robust. So cyber criminals use more subtle tactics, exploiting human error. If an employee opens a malware-laden phishing email or some deceptive social engineering has enabled an attacker to infiltrate malicious codes, the effects may not be evident for some time. This gives malicious attackers the opportunity to explore and exploit the system from within, delivering even more devastating consequences over time.

Given that the current MTTI metrics show that breaches can remain undetected for an average of five and a half months, this provides hackers with ample time to develop their strategy and exploit the weaknesses they detect. So although it will always be necessary to have robust external defences in place, organisations would do well to push the identification of attacks further up the priority list.

The other issue is, of course, containment. The current MTTC metrics show that the average breach, once identified, takes over two months to be contained. The reputational and financial implications of this delay cannot be underestimated.

While building both an external and internal defence is a priority, making detailed plans for how to handle a crisis is equally important. It is perhaps counter-intuitive to plan for a successful attack, but the maxim ‘expect the best but plan for the worst’ is sound advice. Knowing how to react in the unfortunate event of a data breach is a crucial business benefit. An experienced Retained Forensics company will be able to assist you with your plans and help to get everyone into the right mind-set. If the worst does happen, then staff will have a framework to refer to, ensuring that vital steps are taken, and valuable time is not lost.

At SRM, our consultants use their vast expertise to proactively protect systems before an attack occurs. Working with a Retained Forensics specialist facilitates a strategic approach; from analysing potential weaknesses, to making detailed plans in the event of a breach. This is done in a number of ways, including through the process of Test and Exercise, starting with automated penetration testing to identify potential internal vulnerabilities. Manual testing is then employed to exploit and develop these weaknesses, so the gaps can be plugged. The synergy of these tests provides valuable intelligence about where existing vulnerabilities lie, including the human element, and helps a business to build an agile defence around them.

 

To find out more about SRM’s Retained Forensics and Incident Response services contact Mark Nordstrom on 03450 21 21 51 or mark.nordstrom@srm-solutions.com

To receive notification of other blogs relating to issues in the world of information security, follow us on Linkedin.

Or read more from our blog:

Retained Forensic & Incident Response Service: how planning for the worst can add value to your business

Three stages to building a robust defence against external threats

Cyber insurance may be null and void with ‘due care’

Pen testing: seeing both the wood and the trees

Posted 3 weeks ago on · Permalink