Security Operations: Optimizing Response Times

Efficient and effective actions can be the difference between a minor disruption to an organization and a catastrophic one. By implementing key strategies such as automation, advanced threat detection, well-developed incident response playbooks, regular training drills, and efficient communication channels, organizations can significantly enhance their ability to respond quickly and effectively to cybersecurity incidents. These strategies not only mitigate the impact of breaches but also build a resilient security posture that can adapt to evolving threats. In this section, I will explore these critical strategies in detail, providing actionable insights to help organizations bolster their response capabilities and protect their environment.

Organizations must leverage automation to address the increasing number of security events it faces on a minute by minute basis. Automation takes the repeatable tasks that humans traditionally would need to manually execute, and automatically executes them often at a much faster pace than a human could accomplish alone. For example, take a scenario of security monitoring of security events. A security analyst receives an alert that indicates a phishing attempt has been detected in a user’s mailbox. In order to effectively respond to the alert, the analyst must derive certain information from the email headers, such as sender address, MTA reputation, and other recipients. The URLs should be inspected, and any documents should be detonated in a sandbox to determine the intentions of the adversary. These things take time to accomplish; however, there are SOAR solutions that will enrich the data, retrieve the necessary elements from the email headers, perform the reputation look up and detonate the attachments. All of this is automatable, saving the analyst hours of investigation time.

Advanced threat detection is critical to get a head start on responding to true positive incidents in the environment. Security Information and Event Management (SIEM) systems collect and analyze security data from various sources in real-time to identify and respond to anomalous events and potential threats. They provide centralized logging, correlation of security events, and automated incident response capabilities. Endpoint Detection and Response (EDR) tools monitor endpoints for suspicious activity, providing visibility into endpoint behavior, detecting anomalies, and enabling rapid investigation and response to threats. Intrusion Detection Systems (IDS) and Intrusion Protection Systems (IPS) monitor network traffic for signs of malicious activity such as malformed traffic, alerting security teams to potential threats and automatically blocking or mitigating identified threats. Threat Intelligence Platforms (TIP) aggregate threat intelligence data from multiple sources, providing actionable insights and context to help security teams prioritize and respond to threats more effectively. User and Entity Behavior Analytics (UEBA) systems use machine learning and statistical analysis to establish baseline behaviors for users and entities. They detect deviations from these baselines, identifying potential insider threats or compromised accounts. Network Traffic Analysis (NTA) tools, such as Darktrace, Corelight, and Cisco’s Stealthwatch monitor and analyze network traffic to detect suspicious patterns and anomalies indicative of cyber threats. They provide deep visibility into network activity, helping to identify and respond to threats in real time. Finally, Next-Generation Firewalls (NGFW) incorporate advanced features such as application awareness, integrated intrusion prevention, and cloud-delivered threat intelligence to detect and block sophisticated threats at the network perimeter. Advanced threat detection systems are a force multiplier in reducing response times for responding to incidents; however, the actions that the security analyst takes after detection and automated actions occur that can introduce a significant variance to response time.

One can not underestimate the importance of well-developed incident response playbooks. Once an organization determines their preferred incident response methodology to use (SANS PICERL or NIST), playbooks should logically lead the security analyst with crisp instructions and key milestones through the response for a specific threat. Case reviews give the team an opportunity to identify enhancements to processes and encourages organic growth of processes and playbooks.

It is critical for any first responding organization to practice their security operations and incident response processes. Muscle memory develops as a result, reducing processing time and indecision. The introduction of checklists provide a roadmap of order of operations and a feedback mechanism to ensure quality is maintained throughout an otherwise stressful situation. One possible manner to train incident response personnel is to play Backdoors and Breaches from Black Hills Information Security. However, organizations are encouraged to introduce a variety of drills and training opportunities to keep morale high and teams ready.

Finally, effective communications channels should be established and incorporated into drills and playbooks to minimize confusion and prevent a duplication of efforts. When establishing communications channels, it is recommended that organizations implement both a standard and an out-of-band communications channel using Signal, Slack, or some other alternate infrastructure. Doing this will give incident response teams the minimum lifelines necessary to communicate to one another should the standard communications channel be untrusted.