News
Arbor Networks Incident Response Profile Assessment Highlights the Business Benefits of Hunting for Unknown Threats
June 2015 by Marc Jacob
Arbor Networks Inc. launched a new tool to help security teams assess their current incident response profile and capabilities versus their peers and state of the art practices. The assessment provides actionable insights to prompt companies to evolve beyond existing detect and respond models that are becoming increasingly ineffective in the current threat environment.
The Arbor Assessment tool is based on a year-long set of in-depth interviews of security officers across multiple industries. Incident Response Profiles that used “proactive” processes and security resources to hunt for attacks and integrate threat intelligence actively into their response function, had found and contained advanced attacks much faster than those in Detect and Respond models. Organisations that had matured their functions to include threat hunting and integrated intelligence processes reported mean dwell and contain times of under 21 days to identify, and less than 5 days to contain a threat. Industry averages are 10 times these metrics.
While defensive security has its place, moving to a more proactive model offers the only realistic alternative for protection against sophisticated and increasing advanced attacks. Evolving to a hunting posture requires adjusting investments and reallocating resources, but most significantly, it requires a change in the focus and organisational structure of security teams. Though the right technology can help, there is no technological “magic bullet.” A transformation in the people and processes will be required to be successful.
