1-10-60: Measuring the speed of incident response

Ronald Pool
Additional contact information
Ronald Pool: CrowdStrike, UK

Cyber Security: A Peer-Reviewed Journal, 2020, vol. 3, issue 4, 308-314

Abstract: Threat intelligence reports have started to record adversary activities with such high fidelity that it is now possible to record how rapidly they perform their actions, showing that some adversaries are moving at staggering speed in some attacks and have highly professional operations. One such report is CrowdStrike’s ‘Annual Global Threat Report’,1 in which breakout time is used as a measurement of the speed of operations of cyber adversaries. But no matter which measurement we look at, it is clear that the attackers have a very efficient operation and do not suffer from the challenges the defenders face in their day-to-day operations that prohibit them from detecting, analysing and containing an incident rapidly before it spreads. This paper will discuss the speed at which the defensive side should operate and some of the challenges with, for instance, business processes they come across in order to keep up with the pace of the attackers.

Keywords: incident response; attack speed; APT; eCrime; breakout time; 1-10-60 (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2020
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/5810/download/ (application/pdf)
https://hstalks.com/article/5810/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2020:v:3:i:4:p:308-314

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().