Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/12/2017
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Crowdsourcing 20 Answers To Security Ops & IR Questions

"Those who know do not speak. Those who speak do not know." Why it pays to take a hard look at our own incident response functions and operations.

Recently, I was invited to present to a group of people interested in learning more about security operations and incident response - or so I thought. I’m sure you can imagine my surprise when I encountered a group of people who continuously interrupted and even spoke among themselves while I was presenting. Now, I am quite used to, and in fact, encourage questions mid-talk. But this was different. These were not respectful interruptions to ask questions or make clarifying points. Rather, this group seemed intent on continuously telling me that they already knew everything.

Of course, there are many approaches to security operations and incident response that differ with the approach I encourage.  But what became apparent to me in this particular room over the course of the hour was that nearly ALL of the people from various organizations in the room had absolutely NO approach to security operations and incident response whatsoever. I was able to assess this by asking a number of different questions throughout the talk. And, as is my style, I tried to take a lesson from this experience. 

Although most of the organizations I work with don’t come anywhere near this extreme view of totally unjustified overconfidence, the experience inspired me to write today’s column: 20 questions we, as security professionals, should ask ourselves about our respective security operations and incident response functions. Let’s get started:

1.  What is our vision?  Do we understand the big picture of where we are trying to bring our security program?

2.  Have we taken a formal approach to risk assessment?  Security is, after all, about managing, minimizing, and mitigating risk.  If we do not approach this task formally and strategically, it is difficult to see how we will be able to complete it properly.

3.  What inputs have we collected for our risk assessment?  Have we spoken with the board, executives, customers, partners, and other stakeholders?

4.  Are we knowledgeable regarding the threat landscape we face?  Each organization faces unique risks and threats. Reliable, high quality intelligence can help us better understand the landscape we face.

5.  Have we properly prioritized the risks and threats we face?  No organization has infinite budget, time, and resources. Thus, tackling challenges in priority order becomes critical to successfully maturing.

6.  Have we taken the time to develop precise, targeted, and incisive logic to identify activity and behavior that may indicate exposure to one or more of the risks we’ve prioritized previously?

7.  Are we keeping our signal-to-noise ratio in check?  Have we made sure to keep the signal (true positives) high and the noise (false positives) low in order to generate a reasonable alert volume that the organization can work with on a daily basis?

8.  Have we concentrated all of our eventing and alerting into a single work queue?  It is extremely difficult to manage an organization working out of multiple different work queues.

9.  Do we have mature processes and procedures in place?  Each alert can be looked upon as a jumping off point into an investigative workflow.  The end result of this workflow is a decision point: whether or not incident response is required.  As such, it is imperative that the investigative workflow for each alert type is well documented and understood.

10.  Have we adequately trained our team?  No matter how good an organization’s processes and technology are, its people need to understand what they need to be doing and why they need to be doing it.

11.  Do we have integrated case management?  I once worked for someone who would often remark, “If it isn’t written down, it didn’t happen.”  This is so true, particularly in the security realm where we are constantly expected to show what results we have produced with the budget we have been allocated.

12.  Have we reduced or eliminated blind spots?  Lack of visibility is the enemy of security operations.  Ensuring visibility across network, endpoint (including mobile), applications (whether on-premise or hosted), and cloud infrastructure is critical to providing the data needed to make educated security decisions.

13.  Are we set up for investigative success?  Any alerting needs to be enriched with important contextual data and supporting evidence before any educated decision can be made as to its true nature.  If people, process, and technology aren’t in place to facilitate the investigative process, it impedes the entire decision making process.

14.  Have we leveraged orchestration and automation where appropriate?  Can we save valuable human cycles by automating some or all parts of specific processes and procedures?

15.  Do we have a three-layered approach to detection?  Signature-based detection isn’t enough by itself, and neither is detonation-based (sandbox-based) detection.  We also need the analytics-based layer of detection that I’ve discussed in depth previously in this series.

16.  Have we remembered to allow for hunting?  No matter how good rules and logic are, they will only get us so far.  If we’ve optimized resources correctly, we can focus some analyst cycles on hunting for those bizarre behaviors and cryptic activities that will fly by even the most advanced detection mechanisms.

17.  Have we leveraged intelligence properly?  Proper context is critical to timely and informed decision making.  Some of that context comes from supporting evidence and telemetry data.  But some of it also comes from a broader understanding of who may be after me, what they may be after, and why they may be after me.

18.  Have we presented the narrative?  Humans makes decisions best when presented with a complete story, a painted picture, an assembled puzzle.  Analysts perform best when presented with a narrative, rather than a lengthy queue of context-less alerting.

19.  Are we prepared?  What will happen when we need to perform a serious incident response?  Do we have all the necessary puzzle pieces put together in the right place?

20.  Are wecontinually learning?  No matter how mature our security program is, there is always room for improvement.  Take lessons learned each and every day and feed them back into the security operations and incident response function to strengthen it.

As the famous Chinese philosopher once said, “Those who know do not speak. Those who speak do not know.”  Of course, not all organizations represent the extreme that I encountered a few weeks ago.  Nonetheless, there is a lesson here that we can all benefit from.  It pays to take an earnest look at our own security operations and incident response functions.

Related Content:

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
garrytroomen
50%
50%
garrytroomen,
User Rank: Apprentice
3/6/2017 | 6:00:23 AM
192.168.l.l
long sought clarification on this topic
Row3n
0%
100%
Row3n,
User Rank: Strategist
1/16/2017 | 12:22:59 AM
Hi
I personally think that it's the newer generation who acts like this - so many of the strawberry generation have forgotten what it's like to have respect for someone in the know. It's better in the finance business where people are expected to be polite and respectful as a way of life, but in other cases... I don't have a good impression of the kids at all.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
CVE-2020-15821
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
CVE-2020-15823
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15824
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
CVE-2020-15825
PUBLISHED: 2020-08-08
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.