incident-response

Major Incident Management Process

Introduction

As cybersecurity measures are improving day by day, threat actors are also being sophisticated and creating high profile attacks to evade modern defense systems. These attacks result in generating major incidents, which are the highest-urgency and highest-impact incidents that can affect too many individuals or/and companies at the same time depriving critical data or hampering critical business operations.

Continue reading

Why Should You Investigate Security Threats

Why Should You Investigate Security Threats?

Cyber space is continuously evolving and so are the attack techniques employed by the attackers to harm a business, whether financial or reputational. With the increased malicious activities on the internet, cyber security is not a 9-to-5 job anymore. It requires continuous security monitoring of your organization’s technical infrastructure so that even if a security incident occurs, it is contained immediately and mitigated without causing large-scale damage to the organization.

Continue reading

SOAR Functional Components (Part 2)

Incident Management and Collaboration

Incident Management and Collaboration is another of Security Orchestration, Automation and Response (SOAR) platforms’ essential practice whereby security teams can manage security incidents, collaborate, and share information to deal with the incident efficiently and effectively. The best incident management and collaboration plan answer the following questions:

Continue reading

Security Orchestration, Automation, And Response (SOAR) Overview

Definition

As per Gartner definition, SOAR is the set of technologies that allow enterprises to collect security threats’ alerts and data from multiple sources, and then perform incident analysis and remediation process by using both human skills and machine power together to help in defining, prioritizing, and driving standardized incident response activities in accordance with a standard workflow. The SOAR tools enable companies to describe incident analysis and response procedures, also known as “Plays” in a Security Operations Playbook, in a digital workflow format.

Continue reading