Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/2/2017
10:00 AM
Tom Webb
Tom Webb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

How to Succeed at Incident Response Metrics

Establishing a baseline of what information you need is an essential first step.

Collecting metrics for your incident response team is as critical as training your team. Without metrics, it is nearly impossible to determine how effective your team is, if your technology investments are performing as expected, and how satisfied management is with the current results. The hardest part is getting started, but it’s the beginning of really great data analytics.

Establish a baseline of what information you need to answer the questions that are most important to your team. Below are the most basic metrics all teams should keep, but you may have others you want to track to help with making a business case for control.

  • Time from compromise to discovery (dwell time)
  • Time from alarm to triage
  • Time to close
  • Incident classification
  • Detection method

When determining how to classify your incident into categories, it is best to use an already developed taxonomy instead of creating your own. By doing this, you will be able to easily compare yourself with peers and published reports. The VERIS framework is one of the more popular choices, and the Verizon Data Breach Investigations Report uses this framework, which allows you to compare yourself to this report yearly. Here is a great list of the most common taxonomies. Another thing to consider when choosing a taxonomy is if your peers in your industry have a preferred choice.

This can be tricky because your initial choice might be to expand your current tracking to facilitate this new data. If you are already using a tool like Request Tracker Incident Response, by creating custom fields, you can track these data points. And for the basic data points, this works fine. Most people seem to run into issues when they start trying to collect most, if not all, of a complex taxonomy. Depending on how flexible your tools are and how complex making these changes would be, it might make more sense to use a survey type of tool for entering and mining just the metadata of your incidents and keep your case note in your current tracking system.

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Once this data is available, you can start measuring how changes affect your environment. It is important to track when processes change, new tools are implemented, what personal changes happen, etc. All of these things will make the number fluctuate. You should expect an additional junior staff hire to lengthen time-to-close initially, but you should see your dwell time shorten because you have more people looking for incidents. Some of the more useful questions I try to answer with the data are below.

  • What is your average/median time for detection?
  • How much time are you saving by implementing the new process?
  • What types of incidents are taking the longest? Do you need more training or better tools?

Having this baseline in place for the past few years has helped me draw some very useful conclusions. If management isn't satisfied with how quickly you are finding incidents, you should have numbers to support your recommendations to address the issues. If you spent $500,000 on a new tool but it only leads to detecting 20 incidents, is this something you should continue to support? This data has been very powerful for my team in making lots of business cases for change, and without it, I believe we would not be nearly as effective or efficient.

Note: Tom Webb will be giving a talk on this topic at an upcoming SANS event in Washington, D.C., in July.

Related Content:

Tom Webb is an incident handler for the SANS Internet Storm Center. He currently leads a team of six that perform incident response and forensics investigations and vulnerability management. He has 12 years dedicated to security. Tom holds several certs, including the GSE and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/6/2017 | 7:56:12 AM
Very Helpful
Thank you for creating this article. I have been tasked with performing these functions at my current employer so this really hits home for me.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15394
PUBLISHED: 2020-09-25
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.
CVE-2020-15521
PUBLISHED: 2020-09-25
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
CVE-2020-26103
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
CVE-2020-26104
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
CVE-2020-26105
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).