{"id":6141,"date":"2022-10-24T10:21:25","date_gmt":"2022-10-24T14:21:25","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=6141"},"modified":"2022-10-24T10:21:25","modified_gmt":"2022-10-24T14:21:25","slug":"cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/","title":{"rendered":"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?"},"content":{"rendered":"

\"Dwell<\/a><\/p>\n

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Corey Nachreiner of Watchguard Technologies<\/a> examines how playing limbo with dwell time can knock businesses flat on their backs.<\/strong><\/em><\/p>\n

\"PremiumAnyone who has done even a little physical home or office security knows the value of internal motion detectors, cameras, and burglar alarms, even though all these security controls trigger after an intruder has broken in and gotten past your preventative locks, fences, and other barriers. Why are all these post-breach alarms important? Because the alarm is intended to cut down the dwell time of the criminal. If you significantly limit the amount of time an intruder has to do their dirty business, you might still prevent them from attaining their goal or motive. Researchers have found that these sort of burglar alarms, or dwell time deterrents, are effective at dissuading burglars from finishing their crimes, as documented in this study.<\/p>\n

Is lowering cyber-criminal dwell time\u2014also conveyed as mean-time-to-detect (MTTD), mean-time-to-respond (MTTR), or some combination of both\u2014as effective at preventing hackers from accomplishing their objectives? That\u2019s what this article explores. My too long; didn\u2019t read (TL;DR) spoiler is lowering cyber threat dwell time always helps some, but until you reduce it to under a few hours or days, many of those cyber-attacks will still succeed in their objective. Often, successful cyber-attacks happen in minutes to hours. Dwell time is less important when criminals go for quick data smash and grabs, especially when data moves at the speed of the wire.<\/p>\n

That aside, it\u2019s still worth analyzing how cyber threat dwell time has lowered over time and what security benefits it has.<\/p>\n


Widget not in any sidebars
<\/p>\n

The Good News: Dwell Time is Down!<\/strong><\/h3>\n

Before I burst the bubble, let\u2019s start by celebrating the industry\u2019s improvement, which I believe is due to more organizations deploying better internal detection and response controls (like EDR, XDR, and SIEM tools). According to Mandiant\u2019s M-Trends report for 2022, the median dwell time for cyber threats is down to 21 days in 2021. To put that in better perspective, while that\u2019s only three days lower than 2020\u2019s results, it\u2019s 184 days lower than 2014\u2019s 205 days. Lowering dwell time from about seven months to just under a month is great progress.<\/p>\n

That said, not every group monitoring dwell time shows such rosy results. IBM and Ponemon Research have published their Cost of a Data Breach Report for many years and have tracked dwell time-related metrics over a long period. According to their 2022 report, the mean time to identify a threat is 323 days, though it drops to 249 days if the organization has deployed some automated threat detection technology. In any case, with many reports showing dwell times of more than half a year, it is great to see at least one new survey suggesting some organizations are spotting threats or infections within a month.<\/p>\n

However, here are the hard questions. Does dwell time going from 200+ days to 21 days really help that much when it comes to mitigating the cyber-attack? The answer is maybe a little, at least for the most sophisticated and targeted breaches like supply chain attacks, but not so much for many other cyber-attacks that can occur in minutes.<\/p>\n

While there are exceptions, most network or data compromises require some form of lateral movement before the threat actor reaches their real objective. This is good for defenders from a detection standpoint. It means the first computer the attacker infects, which starts the clock on dwell time, rarely gives the attacker what they need regarding their real motive. For instance, they may have infected the device of a low-privileged and low-ranking employee who doesn\u2019t directly have access to whatever information or resources the attacker really wants. This forces the attacker to spend more time and effort enumerating the target\u2019s internal network to find additional ways to pivot their access to more valuable resources and employees, which might give more time to discover and interrupt the threat. The bad news is this lateral movement tends to be relatively easy to do once attackers have broken past the crunchy exterior of the victim\u2019s defenses and gained access to even a low-privileged computer on the soft and chewy interior. In many cases, lateral movement probably only takes hours to days, or in a more extreme case, maybe a week.<\/p>\n

However, lateral movement can take longer for more sophisticated attacks targeting more secure organizations that also deploy internal controls (think segmentation and the zero trust paradigm). For instance, in a software supply chain attack, the threat actor often needs to gain administrative access to source code or software packaging servers. These are usually among the most protected assets in an organization. In those extreme cases, where a victim has good internal segmentation and security, it might take weeks for the attacker to pivot to the intended source code targets in the victim\u2019s network. In that case, organizations that have reduced their cyber threat dwell time to 21 days or less still have a chance to prevent the final attack, even if the attacker technically made it into their systems.<\/p>\n

The Bad News: Most Cyber-Attacks Succeed in Minutes to Days!<\/strong><\/h3>\n

As you have likely guessed, the problem is that most cyber-attacks complete in well under 21 days, some only taking minutes to hours. While seeing dwell time drop greatly from 200 days to 21 shows good progress for our industry that I\u2019d like to acknowledge, the truth is 21 days is still far too long. If we want breach detection to give us a chance at preventing the repercussions of most cyber-attacks, we need detection and response to complete within 24 hours to a few days at most.<\/p>\n

Let me give you an example. Many data breaches where attackers stole huge databases of big companies have been due to SQL injection attacks. Once an attacker finds an exploitable SQL injection flaw on a victim’s website, exploiting it literally takes seconds. Once they exploit the flaw, it might take a few more minutes to craft the right query to suck down the website\u2019s entire SQL database, but at that point, the remaining time for the attack simply has to do with how much data is stored in the database, and the line speeds of the victim and attacker., At worst, it will take about two and a half hours to download one terabyte (TB) of data, but even I can download a terabyte in minutes at home with a consumer 1Gb connection. In other words, many SQL injection attacks go from exploit to sucking down all your database data in under an hour.<\/p>\n

That\u2019s just one example, but even with lateral movement, once an attacker is in your network, the path to domain admin credentials is often less than a day. Recently, ransomware authors, like those behind Astrolocker 2.0, have taken up \u201csmash and grab\u201d tactics, where their whole goal is to go in and steal and encrypt data quickly, avoiding the chance of detection that more methodical ransomware campaigns might risk.<\/p>\n

In short, many cyber-attacks happen in minutes or hours, so until dwell times hit that scale, we can\u2019t over-celebrate the recent decrease to 21 days, even if it\u2019s exponentially lower than before. Imagine if you had a house alarm that didn\u2019t go off until 21 days after your window was broken. Obviously, the criminal would be long gone with all your valuables; never even hearing said alarm. Until our cyber detection alarms get significantly closer to the initial breach event, like house alarms, we need to continue to drive down threat dwell time by deploying better detection and response tools, such as EDR, XDR, or SIEM systems.<\/p>\n


Widget not in any sidebars
<\/p>\n","protected":false},"excerpt":{"rendered":"

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Corey Nachreiner of Watchguard Technologies examines how playing limbo with dwell time can knock businesses flat on their backs. Anyone who has done even a little physical home or office security knows the value of […]<\/p>\n","protected":false},"author":376,"featured_media":6142,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[2079,2077,1698,16,11,2078,1676,2087,2080,2082,2081,2083,1994,477,2084,2085,1365,2086],"acf":[],"yoast_head":"\nCyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?<\/title>\n<meta name=\"description\" content=\"Corey Nachreiner of Watchguard Technologies examines how playing limbo with dwell time can knock businesses flat on their backs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Corey Nachreiner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/\",\"name\":\"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg\",\"datePublished\":\"2022-10-24T14:21:25+00:00\",\"dateModified\":\"2022-10-24T14:21:25+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/be85c081b6d6ec7755986b8c58bfd39f\"},\"description\":\"Corey Nachreiner of Watchguard Technologies examines how playing limbo with dwell time can knock businesses flat on their backs.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg\",\"width\":800,\"height\":400,\"caption\":\"Dwell time\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services\",\"description\":\"Identity Access Management (IAM) News, Best Practices and Buyer's Guide\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/be85c081b6d6ec7755986b8c58bfd39f\",\"name\":\"Corey Nachreiner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1bb80b0a99f29b77bbf2a52875c4cf7a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1bb80b0a99f29b77bbf2a52875c4cf7a?s=96&d=mm&r=g\",\"caption\":\"Corey Nachreiner\"},\"description\":\"Corey Nachreiner is the CSO of\u202fWatchGuard Technologies. A front-line cybersecurity expert for nearly two decades, Corey regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the\u202fSecplicity Community, which provides daily videos and content on the latest security threats, news and best practices. A Certified Information Systems Security Professional (CISSP), Corey enjoys \\\"modding\\\" any technical gizmo he can get his hands on and considers himself a hacker in the old sense of the word.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/cnachreiner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?","description":"Corey Nachreiner of Watchguard Technologies examines how playing limbo with dwell time can knock businesses flat on their backs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/","twitter_misc":{"Written by":"Corey Nachreiner","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/","url":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/","name":"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg","datePublished":"2022-10-24T14:21:25+00:00","dateModified":"2022-10-24T14:21:25+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/be85c081b6d6ec7755986b8c58bfd39f"},"description":"Corey Nachreiner of Watchguard Technologies examines how playing limbo with dwell time can knock businesses flat on their backs.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/10\/Cyber-Attack-Dwell-Time-How-Low-Can-You-Go-Before-It-Really-Helps.jpg","width":800,"height":400,"caption":"Dwell time"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/cyber-attack-dwell-time-how-low-can-you-go-before-it-really-helps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Cyber-Attack Dwell Time: How Low Can You Go (Before It Really Helps)?"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services","description":"Identity Access Management (IAM) News, Best Practices and Buyer's Guide","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/be85c081b6d6ec7755986b8c58bfd39f","name":"Corey Nachreiner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1bb80b0a99f29b77bbf2a52875c4cf7a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1bb80b0a99f29b77bbf2a52875c4cf7a?s=96&d=mm&r=g","caption":"Corey Nachreiner"},"description":"Corey Nachreiner is the CSO of\u202fWatchGuard Technologies. A front-line cybersecurity expert for nearly two decades, Corey regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the\u202fSecplicity Community, which provides daily videos and content on the latest security threats, news and best practices. A Certified Information Systems Security Professional (CISSP), Corey enjoys \"modding\" any technical gizmo he can get his hands on and considers himself a hacker in the old sense of the word.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/cnachreiner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/6141"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/376"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=6141"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/6141\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/6142"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=6141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=6141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=6141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}