Finding balance with a cyber incident response plan
When it comes to responding to an incident, bad timing wastes resources. And traditional incident response strategies paired with traditional detection tools make it very hard to get the timing right.
If an organization starts recovery efforts too early, it can start acting on events that turn out to be benign. This leads to wasted resources.
If an organization starts recovery too late, it can end up letting attacks continue so that the issues become more widespread and complex, which then require more resources to remedy and can have larger impacts on the business.
Somewhere in between, there is an optimal stage in which the security teams are not wasting time on benign events, but in which incidents are not allowed to escalate too far. But this sweet spot is hard to ascertain, especially when detection tools are prone to false positives and more sophisticated or novel attacks often fly under the radar of signature-based tools.
This can be illustrated graphically, with the amount of time passed until a security team activates incident response measured along the x-axis, and the amount of resources required on the y-axis. You'll notice a spike at the very beginning due to the high frequency of non-events, which eats away at resources as the security team reacts to many events that turn out to be benign.
Graph for illustration purposes only.
The problem of responding to an incident too late is heightened by static incident response playbooks. Incident response playbooks are often created in ‘one-size-fits-all’ format for general attack types – you might have one for ‘ransomware’, one for ‘DDoS attacks’, and so on. They outline the necessary steps to eradicate the attack, remediate infected assets, gather evidence, communicate internally, and ultimately recover.
While these playbooks help satisfy auditors and compliance requirements, they aren’t often used in the real world, because the reality of an attack never quite aligns with the generic parameters set out in the playbook. The playbook is static, while businesses – and the threats that target them – are constantly evolving. This is especially true with the rise of generative AI, which allows attackers to carry out sophisticated and innovative attacks on a large scale.
In other words, every traditional playbook is outdated the day it is written. The mismatch between attacks and the playbook’s response plan puts the burden on the human team to fill in the gaps, as the human's attention moves from following step-by-step instructions to making real-time decisions. Forced to synthesize the entire event under stressful circumstances, often with limited information, they begin to deviate further and further from the playbooks, rendering them less and less relevant.
By responding only to genuine security incidents, and initiating actions before those incidents become a crisis, security teams reduce the amount of resources required. But this is only possible with accurate detections and investigative tools that give you all the information you need on a silver platter.
Using AI for faster and more efficient incident response
With Darktrace HEAL™, defenders can now initiate incident response earlier, during the optimal window of time. AI technology learns from your business data at speed and scale to identify and investigate events in real time and determine what activity requires attention. It automatically connects the dots between individual unusual events DETECT alerts to look for wider security incidents, which are then subject to HEAL’s recovery capabilities.
HEAL uses this data to enable security teams to address emerging critical incidents earlier, while eliminating unnecessary time and effort spent on irrelevant events. By lowering the threshold for activating incident response and using automation, organizations can make earlier and more informed decisions, resulting in swifter and less resource-intensive recovery.
Two things now happen to our graph. First, the entire curve shifts downwards due to better tooling. The security team now benefits from automation, bespoke AI-generated playbooks, and integrations, and as a result, the amount of resources required drops at every stage of the curve. Secondly, the sweet spot previously unattainable to incident responders due to inaccurate detection and stringent incident response activation policies, becomes achievable.
Graph for illustration purposes only.
Bespoke playbooks accelerate recovery
HEAL automates several steps of the recovery process to accelerate the rate of incident response. It creates bespoke, AI-generated incident response playbooks that leverage an evolving understanding of the organization to determine recovery steps that are tailored to the specific incident and the environment it takes place in. For example, a cloud migration may introduce new architecture that a traditional, static playbook may not consider but HEAL does.
These bespoke playbooks can keep up with changes in both the business and the threat landscape by using Self-Learning AI, which is trained on the organization’s specific data and continuously updates its understanding of the business. As a result of this tailored AI learning, these playbooks can facilitate more efficient incident response during and after an incident by taking relevant actions and not over-responding.
The AI also prioritizes the order of remediation actions based on factors like further damage, how much the attack relies on the specific asset as a pivot or entry point, and if RESPOND has contained the asset's unwanted activity temporarily.
HEAL’s bespoke playbooks apply both in the case of critical incidents that need quick eradication and recovery as well as during day-to-day triage of any emerging incidents. With bespoke playbooks, organizations can tick the compliance box while also having real-world, practical value.
Incident response made simple
Traditionally, organizations struggle to find the sweet spot between responding to incidents too early and too late, increasing the chance that they will waste resources or even face reputational or financial issues.
With HEAL, organizations can now identify and address critical events more effectively. The AI technology uses enhanced detection capabilities to surface significant incidents early without wasting time and effort on irrelevant events. Leveraging bespoke, AI-generated playbooks further streamlines recovery by ensuring applicable recovery plans.
By adjusting the timing of incident response, HEAL uses accurate detection and swift recovery to save security teams time, money, and effort.
HEAL is the final stage of Darktrace’s Cyber AI Loop, an interconnected security ecosystem that helps defenders at every stage of an attack lifecycle. AI outputs flow between each product – Darktrace PREVENT™, Darktrace DETECT™, Darktrace RESPOND™, and HEAL – to continuously and autonomously harden security.
Like this and want more?
