{"id":2165,"date":"2018-09-06T11:55:35","date_gmt":"2018-09-06T15:55:35","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=2165"},"modified":"2018-09-06T11:55:35","modified_gmt":"2018-09-06T15:55:35","slug":"improving-enterprises-incident-response-alienvault","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/","title":{"rendered":"Improving Your Enterprise’s Incident Response with AlienVault"},"content":{"rendered":"

\"Improving<\/p>\n

Threat detection is the name of the game in modern cybersecurity. Prevention by itself is not enough to protect enterprises from the deluge of digital threats enterprises face every day. Hackers are finding increasingly sophisticated vectors to bypass the IT perimeter. Without sophisticated threat detection capabilities, attackers can dwell on enterprise networks for weeks if not months at a time. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n


Widget not in any sidebars
<\/p>\n

Threat detection is not a set-it-and-forget-affair. It requires a dedicated IT security team to perform optimally. With the cybersecurity staffing crisis still in full swing, these enterprise security experts need all the help they can get. Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan to offer the best threat detection. \u00a0<\/span><\/p>\n

Incident response is one of our favorite topics here at Solutions Review. But we can always learn more. Here are some new tips and tricks on incident response from the \u201c<\/span>Insider\u2019s Guide to Incident Response<\/span><\/a>\u201d offered freely by SIEM solution provider AlienVault.<\/span><\/p>\n

What is Incident Response? <\/b><\/h3>\n

An incident response plan is the procedure employees, security team members, and C-suite executives should follow in case they suspect, detect, or recognize a digital threat on the enterprise\u2019s network. A good incident response plan should be part of employee training so it is well-known throughout the entire enterprise. It should also contain clear chains of communication so employees know who to speak to about their suspicions and security experts know who to speak to in case of a data breach in legal, HR, and finance. <\/span><\/p>\n

So how can your enterprise improve its incident response? <\/span><\/p>\n

Incident Response Begins with Preparation<\/b><\/h3>\n

Firstly, incident response can\u2019t be something made up on the fly or in a panic. Indeed, AlienVault argues that panic is the opposite of protection\u2014a true statement if ever there was one. Instead, your enterprise\u2019s incident response plan hinges on its ability to execute it. <\/span><\/p>\n

In part, this means clarifying what your enterprise classifies as a \u201csecurity event\u201d and a \u201csecurity incident\u201d so your security team and employees know what to prioritize in their threat detection efforts. AlienVault reminds us the common saying \u201chackers only need to win once\u201d isn\u2019t exactly true. If your enterprise is on high alert and engaging in threat detection, attackers actually can\u2019t afford to make a mistake. If they\u2019re trying to penetrate your enterprise\u2019s network, any wrong step could wind up being detected and their efforts rendered moot. <\/span><\/p>\n

Of course, the above statement hinges on the ability to recognize a threat as it happens. Therefore, possessing strong cybersecurity threat detection and threat intelligence capabilities via a SIEM or security analytics solution is more essential than ever. <\/span><\/p>\n

Remember, it\u2019s not about protecting every single vulnerability in your enterprise\u2019s network\u2014it\u2019s about minimizing the damage, recovery time, and cost. \u00a0<\/span><\/p>\n

Incident Response Can\u2019t Be Automated <\/b><\/h3>\n

In the case of incident response, preparation also means putting the right security team together. According to AlienVault, this includes a team leader, a lead investigator, communications lead, documentation and timeline lead, HR and legal representation. Of course, this is just the basic composition of a team; yours might be larger or smaller depending on your needs and enterprise size. \u00a0<\/span><\/p>\n

Your incident response team needs to be organized to bring mission focus, evidence collection and event analysis, communication, compliance documentation, and legal advice to the foray. This team need not be located in the same place…and in fact, having them all at the same place may not be advisable if your enterprise has locations across the globe. Plenty of incident response and cybersecurity tactics require manual interaction with endpoints. \u00a0<\/span><\/p>\n

Remember the Golden Rule: Hackers Are Human<\/b><\/h3>\n

Yes, this is the hardest lesson any enterprise can learn. We all have the boogeyman image of the black-hooded hacker, determinately pecking at their keyboard in a shadowy basement, \u00a0working tirelessly to bring enterprises to ruin. <\/span><\/p>\n

Yet 99% of the time, the typical hacker is as human as you or I…with all of the same human foibles. Most hackers are looking for easy targets\u2014the digital low-hanging fruit\u2014and will be easily deterred by the presence of a strong SIEM solution. Indeed, plenty of hackers don\u2019t even have technical skills. Instead, they rely on products purchased from the Dark Web to initiate their attacks. Having a strong incident response plan\u2014properly implemented and constantly reinforced\u2014is another necessary deterrent. \u00a0\u00a0<\/span><\/p>\n

To learn more, be sure to download the \u201c<\/span>Insider\u2019s Guide to Incident Response<\/span><\/a>\u201d provided for free AlienVault.<\/span><\/p>\n

Other Resources\u00a0<\/strong><\/h3>\n

5 Tips for Setting Up a Security Operations Center (SOC)<\/a><\/p>\n

Get Your Employees to Embrace SIEM Best Practices!<\/a><\/p>\n

4 Tips to Make Data Breach Detection Easier For Your Enterprise<\/a><\/p>\n

Enterprises: Don\u2019t Become Complacent in Your Cybersecurity!<\/a><\/p>\n

How to Make Your SIEM Solution Deployment Easier for Your Enterprise<\/a><\/p>\n

Comparing the Top SIEM Vendors \u2014 Solutions Review<\/a><\/p>\n

How UEBA Can Prevent Insider Threats in your Enterprise<\/a><\/p>\n

SIEM vs Security Analytics: What\u2019s the Difference?<\/a><\/p>\n

Should Risk Analytics Bridge the Cybersecurity Talent Gap?<\/a><\/p>\n

What\u2019s Changed? The Gartner 2017 Security Information and Event Management (SIEM) Magic Quadrant<\/a><\/p>\n

The 25 Best Security Analytics and SIEM Platforms for 2018<\/a><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Threat detection is the name of the game in modern cybersecurity. Prevention by itself is not enough to protect enterprises from the deluge of digital threats enterprises face every day. Hackers are finding increasingly sophisticated vectors to bypass the IT perimeter. Without sophisticated threat detection capabilities, attackers can dwell on enterprise networks for weeks if […]<\/p>\n","protected":false},"author":41,"featured_media":779,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[175,353,95,145,112,86,21,57,22],"acf":[],"yoast_head":"\nImproving Your Enterprise's Incident Response with AlienVault<\/title>\n<meta name=\"description\" content=\"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Improving Your Enterprise's Incident Response with AlienVault\" \/>\n<meta property=\"og:description\" content=\"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2018-09-06T15:55:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/\",\"name\":\"Improving Your Enterprise's Incident Response with AlienVault\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg\",\"datePublished\":\"2018-09-06T15:55:35+00:00\",\"dateModified\":\"2018-09-06T15:55:35+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg\",\"width\":800,\"height\":350,\"caption\":\"Findings: The Forrester Wave: Midsize Managed Security Services Providers, Q3 2020\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Improving Your Enterprise’s Incident Response with AlienVault\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Improving Your Enterprise's Incident Response with AlienVault","description":"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/","og_locale":"en_US","og_type":"article","og_title":"Improving Your Enterprise's Incident Response with AlienVault","og_description":"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2018-09-06T15:55:35+00:00","og_image":[{"width":800,"height":350,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/","name":"Improving Your Enterprise's Incident Response with AlienVault","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg","datePublished":"2018-09-06T15:55:35+00:00","dateModified":"2018-09-06T15:55:35+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Having a security team in place by themselves is not enough. They need to be a part of an enterprise-wide incident response plan.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/01\/globalnetwork.jpg","width":800,"height":350,"caption":"Findings: The Forrester Wave: Midsize Managed Security Services Providers, Q3 2020"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/improving-enterprises-incident-response-alienvault\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Improving Your Enterprise’s Incident Response with AlienVault"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2165"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=2165"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2165\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/779"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=2165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=2165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=2165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}