Four tips to speed up your Security Incident Response

Security Incident Response is a critical function to protect the company from harm. It should be fast and efficient! 

What is it about? 

On average, each IT asset is attacked from the Internet every 39 seconds. [1] The threat level of IT assets is high. In addition, you may have only a few employees who are capable of handling security incidents in a qualified manner. The time to react is always short, however detection takes a long time. For example, data breaches in 2019 were only detected after an average of 279 days. 

Design your incident response quickly and efficiently - orchestrate tools, use intelligent workflows and playbooks, overcome silos to IT and prioritize along business requirements.  

How can you accelerate the process and increase efficiency? 

Orchestrate tools 

You know the situation: there are many (IT-) security tools and many sensors, and all of them provide you with information. Are you and your team keeping an eye on all of them? You will get a better overview and gain time if you combine all the information that are relevant to you with your process platform and derive actions from there. You will also gain additional speed if the processing of security incidents is not distributed via emails, documents and various ticket systems, but the necessary stakeholders collaborate on the same platform.   

Set up intelligent workflows and playbooks 

Intelligent workflows and playbooks support you in two ways: through automation and through structure. 

Playbooks define typical cases of security incidents and pre-define how they should be handled in your organization. They provide structure and ensure a uniform procedure for all employees - and thus ensure reliable results when it really matters. 

Automated workflows, in turn, can perform containment tasks quickly and efficiently depending on the situation detected. An example of such tasks are ad-hoc firewall rules to quickly isolate suspicious systems based on data from your sensors (such as SIEM systems). 

Overcoming the silo to IT 

Working closely with IT can make your process more efficient in two ways: 

• On the one hand, knowing the IT infrastructure and its links to business processes supports you, because it gives you risk-based tools to set priorities and quickly find the right business contacts. Useful tools for this are risk management and a well-maintained configuration database (CMDB). 
• On the other hand, you can define workflows jointly and file or even execute changes automatically. This accelerates the initial treatment and containment measures. 

Learning from Security Incidents 

You can also benefit from the retrospective on processed security incidents: The experience gained on procedures, any process hurdles that may have arisen, creative solutions etc. can be used to create additional playbooks or revise existing ones. In addition, impulses for further automation potential may arise. 

Conclusion 

We believe that every company can become more efficient. We also believe that IT platforms play a crucial role in that context. For that reason, we help our customers to improve their processes and support them optimally with IT platforms - the latter mainly through ServiceNow®. Please contact us!

Links 

[1] https://eng.umd.edu/news/story/study-hackers-attack-every-39-seconds