preview

Why So Many Companies Detect A Breach : An Analysis

Decent Essays

Alternate Title

Why So Many Companies Fail to Respond to a Breach Quickly

Cyberattacks are on the rise, and organizations need an organized approach to managing an attack or breach. However, before the security team can respond to a breach, the attack must first be detected. According to an article published on SecurityWeek.com, in 2015, the median time that attackers were in the victim's network before detection was 146 days. While this is a vast improvement over the 416-day window that existed in 2012, there are still breaches that are not detected for years. However, cybersecurity professionals are often too optimistic about how quickly they can detect and respond to a breach. In various surveys, many respondents state that they can …show more content…

As a result, more alerts are generated than staff members can analyze manually.
• Threat intelligence services can provide current information on potential attacks that are relevant to the organization's industry. The problem is that analysts often do not know what intelligence is actionable, much less the actions that they need to take.
• Senior analysts are spending far too much time dealing with repetitive, mundane tasks. After an incident is detected, the next step is to analyze the data associated with the incident. Typically, this requires accessing multiple tools to extract and analyze logs and other data, which can mean that analysts may have to toggle between 20 or more open windows to investigate one incident. Senior analysts are therefore too busy to help junior analysts who often do not know what to do.

What Is the Solution?
What is needed is an intelligent security platform that sees all and serves as a hub for all security products. A security automation and orchestration platform can solve the challenges of detecting and responding to incidents.

• Case management: From creating the case to managing the workload, case management can shorten the MTTR. Case management tools can collect, distribute and analyze data related to an incident, assign an analyst and issue updates to ensure that no threats slip through the cracks.
• Automation: Playbook orchestration can be used to handle mundane, repetitive tasks, including false

Get Access