How Does Incident Response Work in Cybersecurity?

TL;DR

Security equals prevention plus detection plus response. Once a breach is detected, response covers the mean-time-to-contain, which averages about 70 days. A Security Operations Center triages alerts and remediates, moving from manual incident response toward SOAR: security orchestration, automation, and response, using case management and dynamic playbooks to shrink containment time.

Transcript

Remember that equation. This we covered in the last episode of the Cybersecurity Architecture series. Welcome back. This was about security equals prevention, plus detection, plus response. This is basically what we're doing in security. And we talked about at the very beginning of the series some security principles and roles and things like that,... Read More

Key Insights

• Security equals prevention plus detection plus response. Prevention controls span identity and access management, endpoint, network, application, and data domains, detection does the monitoring, and response handles what happens after a problem is discovered.
• Mean-time-to-identify (MTTI) averages roughly 200 days according to the Ponemon Institute's Cost of a Data Breach survey, meaning attackers sit inside a victim's environment for about 200 days before the breach is even noticed.
• Mean-time-to-contain (MTTC) is on the order of 70 days, representing how long it takes once aware to control the damage, remove the attackers, and get back to operation. This is the response portion.
• These MTTI and MTTC numbers stay roughly the same over the years despite more tooling and understanding, showing the industry has not been effective at reducing the time to identify and contain breaches.
• The Security Operations Center (SOC) is a centralized team that monitors information sent up from each domain, detects anomalous behavior and alerts, correlates it, and then responds to what it finds.
• Traditional incident response (IR) is largely a manual process that relies on heroes and experts whose knowledge lives in their heads. It does not scale well and is not necessarily repeatable, but it cuts breach cost when done well.
• SOAR stands for security orchestration, automation, and response. It aims to make things as automated as possible to reduce containment time, contrasting with the traditionally manual IR approach.
• Dynamic playbooks guide analysts by predetermining that when you see a given signal you run a given routine, with subsequent steps depending on prior results, so less experienced people can follow guidance instead of needing all the expertise themselves.

Questions & Answers

Q: What is the security equation used in the Cybersecurity Architecture series?

Security equals prevention plus detection plus response. Prevention is about the controls put in place across identity and access management, endpoint, network, application, and data domains to stop someone from breaking in or doing damage. Detection is the monitoring layer that discovers anomalous behavior. Response is what you do once a problem is discovered: containing the damage, removing the attackers, and getting back to operation. This final episode focuses on the response portion of that equation.

Q: What is mean-time-to-identify (MTTI) and how long is it on average?

Mean-time-to-identify is the period between when attackers actually get into an environment and when the defenders become aware of it. According to the Ponemon Institute's Cost of a Data Breach survey, this is roughly 200 days on average. That means the attacker can be sitting inside your environment doing who knows what for about 200 days before you finally realize it has happened, which the video describes as a big problem addressed by the detection portion of security.

Q: What is mean-time-to-contain (MTTC)?

Mean-time-to-contain is how long it takes, once you are aware of a breach, to get the damage controlled, get the attackers out, and get back to operation. It is on the order of 70 days according to the numbers cited. This is the response portion of the security equation, and the goal discussed in the video is to shrink that 70 days down to some shorter number through better response practices and automation.

Q: What is a Security Operations Center (SOC) and what does it do?

The SOC, or security operations center, is a centralized team of people whose job is to monitor and look across all the different security domains. Each domain sends its information up so the team can see what is going on. The SOC detects anomalous behavior, alerts, and other signals, correlates all of that information, and then responds. Response is the focus of the episode, and it has traditionally been called incident response or IR.

Q: What is the difference between traditional incident response and SOAR?

Traditional incident response has largely been a manual process that relies on heroes and experts, people who happen to have knowledge in their heads and a gut feel for what to do. That approach does not scale well and is not necessarily repeatable. SOAR, which stands for security orchestration, automation, and response, is the more modern approach. Its idea is to make things as much as possible automated and orchestrated, which should help reduce the time it takes to contain an incident.

Q: What are triage and remediation in incident response?

Triage is determining, when alarms come in, whether an alert is a real attack or just noise, and if real, whether it is significant and in what order of importance to handle cases, since responders never have time to respond to everything as quickly as they would like. The word comes from health care, deciding which patients to see first. Remediation is fixing the problem: blocking, shutting things down, applying software patches, and putting in controls so systems stop leaking data and can get back up and running.

Q: How does case management work in a SOAR system?

When a SIEM or XDR identifies a likely problem, either system can automatically open a case in the SOAR system. The case can be modified, assigned to a specific analyst, and tracked. If done well, the XDR or SIEM also adds artifacts and indicators of compromise, enriching the case with useful information so the analyst does not start from zero. A dashboard can show which cases are open, which are high priority, who is investigating, and allow reassignment as needed.

Q: What are dynamic playbooks and why must they be dynamic?

Dynamic playbooks are predetermined guidance that says when you see a given signal, run a given routine, and based on the results of those steps you might do different next things. They are dynamic rather than a static standard operating procedure numbered one through ten every time, because many cases require flexibility, and what you get from one step determines what you do next. Playbooks let a less experienced analyst follow guidance instead of needing to know everything about everything, ultimately reaching the source and the remediation steps.

Summary & Key Takeaways

• The Cybersecurity Architecture series frames security as prevention plus detection plus response. Prevention covers identity, endpoint, network, application, and data controls; detection monitors for problems. This final episode focuses on response: once a breach is discovered, how the damage gets controlled and the attackers removed.

• Attacks begin with reconnaissance, then damage. Mean-time-to-identify averages about 200 days and mean-time-to-contain about 70 days per the Ponemon Cost of a Data Breach survey. These numbers stay roughly constant over the years despite better tooling, showing the industry struggles to shrink them.

• The SOC triages alerts to separate real attacks from noise and rank significance, then remediates by blocking, patching, and restoring systems. Modern SOAR adds automation, case management, enriched artifacts and indicators of compromise, and dynamic playbooks to guide analysts and reduce containment time.