How many ways can your clients’ businesses be cyberattacked?
The numbers are almost beyond imagining:
- One in ten URLs is malicious;
- Supply chain attacks increased 78%
between 2017 and 2018;
- Web attacks are up 56%;
- Malicious PowerShell scripts have
increased by 100%;
- Formjacking compromises an average
of 4,800 websites every month; - Four times more cryptojacking attempts were blocked in 2018 than in 2017;
- Enterprise ransomware is up 12% — and mobile ransomware is up 33%; and
- Office files account for 48% of malicious email attachments.
Clearly, your clients need to be able to respond effectively to cybersecurity incidents — especially given the high rates of recurring attacks conducted by the same cybercriminals, often using the same tactics, techniques, and procedures.
There are two ways you can help your clients achieve the cybersecurity incident response posture they need to survive a cyberattack. One is to help them build effective incident response plans and playbooks; the other is automation.
Incident response plans and playbooks
Even though an incident response plan reduces the likelihood of an incident carrying on without your clients’ knowledge — and also prevents them wasting time deciding how to react when an incident does happen — 77% of organizations lack a proper incident response plan.
All of your clients should have such a plan, one that describes the general processes to be applied across their entire organization when an incident happens.
Your clients also need a collection of incident response playbooks customized to address specific threats to their businesses in meticulous detail. Typical incident response playbooks focus on malware, phishing, ransomware, data breaches, unauthorized access, and DoS attacks, among many others.
Cybersecurity automation
By adding automation capabilities — artificial intelligence, machine learning, analytics, and orchestration — to cybersecurity incident response, your clients will be able to reduce the time needed to detect, identify, and contain an incident and will be able to minimize the complexity of their IT infrastructures.
Odds are they’ll need help, though, because automating incident response can’t be accomplished with a boxed product your clients can plug in and then forget about.
Instead, they’ll use a Security Operations Center that deploys security orchestration/automation/response (SOAR) technologies designed to aggregate data from a range of sources and generate process- and procedure-aligned workflows that perform repetitive tasks.
These workflows can be orchestrated into dynamic incident response playbooks that adapt in real time and enable automatic incident escalation/remediation. And because security data collection, aggregation, deduplication, and enrichment of cybersecurity data is centralized, your clients get better visibility into their security operations and can respond faster and more effectively to incidents.
Your trusted cybersecurity technology partner can show you the best ways to bring automation to your clients’ cybersecurity incident response.
Partner well, perform better.
Adam
