Despite Heightened Breach Fears, Incident Response Capabilities Lag

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.

A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.

Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.

The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.

"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke is unable to determine which specific trees are on fire.

The data in Wakefield's survey suggests that many organizations are still struggling with familiar, old challenges not just with IR but with other broader information security issues as well. Though a lot has been made about a substantial increase in attack volumes, the growing sophistication of threats, and concerns over SolarWinds-like attacks, enterprise responses appear to be lagging.

Nearly one in two (49%) organizations, for instance, still lack adequate tools, staffing, and expertise to detect or respond to threats. Forty percent have no processes for ensuring third-party compliance with required security controls despite the broadly acknowledged risks that third parties and supply chain partners present to enterprises. Though human error remains one of the primary causes for data breaches, 37% don’t have any employee awareness program.

Troublingly, though, breaches can often trigger major regulatory and legal consequences: Nearly half (47%) of the security leaders in the survey said their IR teams were unsure about when to engage legal counsel. Forty percent described the security group as ill-equipped to deal with all the legal requirements associated with a breach, such as preserving evidence for potential litigation. Organizations in the survey reported a similar lack of preparedness for dealing with breach communication and notification requirements.

"When the 'fog of war' hits, post-incident, it's a bad time to start thinking about a response plan," Oviatt says. Security groups and IR teams need to have already done some of the work ahead of an incident and made sure they understand legal implications, including potential for future legal action.

"If customer data is lost, the company may need to defend itself. If the loss was due to an employee action, the company may need to pursue legal action," Oviatt notes. "Ensuring that both technology and all related processes are in place ahead of time is simply good business management.”

The survey reveals substantial concern among security leaders about data breaches. More than half of the respondents admitted to being more concerned about ransomware attacks, decreased endpoint visibility, and attacks targeting remote desktops and VPN systems.

The general apprehension over breaches and inadequate IR plans appears to have driven many organizations to third-party managed detection and response (MDR) providers. Seventy-six percent presently have engaged a third-party provider for at least some of their detection and response needs. Security leaders perceive MDR providers as helping organizations detect, respond to, and contain breaches faster than they can on their own.

"Third-party firms have seen many more incidents than any one customer has experienced, so they have both well-defined playbooks and people who know how to handle each step well," Oviatt says.

At the same time, an internal team is critical to ensuring that the third-party service provider has the necessary context — such as what constitutes normal activity on the network or the meaning of employee roles — when dealing with an incident, he says.

"Simply put, security is less like a house fire, where the best route is for the owners to get out and let the firefighters handle everything," Oviatt says. "[It's] more like a tax audit, where the professional and the customer work together to ensure that all the right actions are taken."