Despite Heightened Breach Fears, Incident Response Capabilities Lag

Despite Heightened Breach Fears, Incident Response Capabilities Lag
Many organizations remain unprepared to detect, respond, and contain a breach, a new survey shows.

Heightened data breach concerns — especially since the global COVID-19 outbreak early last year — don't appear to have prompted significantly improved incident response (IR) plans or capabilities at many organizations.


A new survey of 500 security and risk leaders conducted by Wakefield Research on behalf of Red Canary, Kroll, and VMware shows more than one-third (36%) of organizations still don't have a structured IR process in place.


Though 70% of respondents reported being bombarded with over 100 threat alerts daily, just 8% described their organizations as having the ability to quickly identify the root cause of an attack. Forty-six percent described their IR teams as typically requiring more than one hour to contain a threat, and 23% of organizations that had experienced three or more compromises over the past year said they needed about 12 hours at least to contain a breach.


The survey shows that most organizations are struggling with an overabundance of security alerts and threat data. Some of the most frequently targeted organizations reported receiving more than 500 alerts a day. But nearly eight in 10 (79%) said they were only able to investigate about 20 alerts at most per day, meaning most alerts that organizations receive — however innocuous — are not being examined at all. Adding to the woes, security teams that do chase down alerts frequently end up spending too much time on low-level threats — meaning that high-level threat alerts can often slip through the cracks.


"Alert noise continues to grow as data and systems grow, so organizations' security teams burn time chasing down alerts that don't matter," says Grant Oviatt, director of incident response engagements at Red Canary. He likens the situation to one where an individual standing in a forest full of smoke i ..

Support the originator by clicking the read the rest link below.