How Well Does Your IR Function Stack Up Against Your Peers?

Share and earn Cybytes
Facebook Twitter LinkedIn Email

How Well Does Your IR Function Stack Up Against Your Peers?


The security community is typically pretty great about sharing information among colleagues, including tips and tricks of the trade. If you want to learn about some of the latest observations and recommendations to enhance your incident response capabilities, I encourage you to watch a new webcast on demand, “Improving the Incident Response Function, SANS 2018 Incident Response Survey.” Matt Bromiley, a SANS Digital Forensics and Incident Response instructor, shares the survey results as well as advice on how to do better with the teams and tools you already have in place. Joining Matt, our own Ryan Trost, Co-founder and CTO, provides his perspective on the findings, and offers suggestions for how to address some of the toughest challenges when it comes to investigating incidents and breaches. Full survey details are available for download in the report, It’s Awfully Noisy Out There: Results of the 2018 SANS Incident Response Survey.

We all know that incident response teams must operate in a very noisy environment, so it isn’t surprising that this year’s survey focuses on how to work our way through the noise to better defend our organizations. Matt describes the challenge as akin to being at a concert while trying to listen to music on your headphones. Only incident responders can’t leave the concert – they have to deal with an unprecedented volume and variety of malware and hacks, including old indicators that we thought we could retire but are coming back and must be monitored again.

Here are just two takeaways from the webcast that struck a chord (pardon the pun!) with me, but I’m sure you’ll find others:

Ease of visibility = ease of remediation.

While the 452 respondents to the survey believe that they are doing a pretty good job identifying the users and systems impacted by an incident or breach, finding the data and threat actor details involved is much more complex. Only 17.7 percent can consistently and accurately discover the tactics, techniques and procedures (TTPs) used. We can’t thoroughly remediate without visibility into all aspects of a breach or incident. According to Matt, this speaks to the need for better threat intelligence or indicator tracking, as well as better integration and collaboration.

How to map investigations using published adversary profiles.

Having run two large SOCs in the past, Ryan understands the challenge of identifying and tracking TTPs and monitoring the success of defensive countermeasures. In the webcast, Ryan explains how to use the MITRE ATT&CK framework together with ThreatQ for threat hunting, exploring every corner of your organization to pinpoint adversary TTPs. With the ability to find all the malicious activity within the environment, incident response teams can ensure total remediation.

The webcast also reveals the top impediments for security professionals in 2019, including a shortage of staffing and skills, lack of budget and poorly defined processes. Matt offers workarounds and advice on how to use your existing resources creatively to address many of these priorities with little cost. Watch the recording now and download the report to learn where to start to find the most success and make life easier in the coming year.

About ThreatQuotient™

ThreatQuotient™ understands that the foundation of intelligence-driven security is people. The company’s open and extensible threat intelligence platform, ThreatQ™, empowers security teams with the context, customization and prioritization needed to make better decisions, accelerate detection and response and advance team collaboration.


The post How Well Does Your IR Function Stack Up Against Your Peers? appeared first on ThreatQuotient.

Share this post and earn Cybytes
Facebook Twitter LinkedIn Email
About ThreatQuotient
ThreatQuotient™ understands that the foundation of intelligence-driven security is people. The company’s open and extensible threat intelligence platform, ThreatQ, provides defenders with the context, customization and collaboration needed to ensure that intelligence is accurate, relevant and timely to their business. Leading global companies are using ThreatQ as the cornerstone of their threat operations and management system, increasing security effectiveness and efficiency. For more information, visit

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Support Cybrary

Donate Here to Get This Month's Donor Badge


We recommend always using caution when following any link

Are you sure you want to continue?