Breach Response

The entire focus of cybersecurity shifts to breach response whenever inbound attacks manage to bypass access controls and defensive measures to become incidents causing direct harm to IT and data—and by extension the whole company. Everything done to terminate the breach, minimize the damage, and mitigate the underlying problems falls under the heading of breach response. As attacks become faster, sharper, and more destructive, security teams must strive to improve at breach response faster than their threat exposures.

An Overview of Breach Response

What is a breach response?

If a cybersecurity incident escalates into a situation where personally identifiable information (PII) is affected, it is classified as a data breach. Security teams will undertake a systematic effort to contain, eradicate, and recover as part of a process called breach response. Often considered a specialized discipline of incident response, breach response focuses specifically on dealing with exposed data and all the damage it can cause. 

What is the breach response lifecycle?

With breach response, as with incident response, security teams are advised to always follow the same series of steps while responding:

1. Preparation – Planning, training, and monitoring to be ready for the next attack.
2. Detection – Identifying that sensitive information has been compromised.
3. Emergency Response – Taking immediate steps to keep the damage in check. 
4. Evidence Gathering – Tracking the attack backwards to the initial compromise. 
5. Breach Analysis – Understanding where, when, why, and how the breach occurred.
6. Mitigation – Doing whatever is necessary to contain, eradicate, and recover. 
7. Notification – Identifying clients, customers, and regulators as required. 
8. Review – Looking back at the breach response for strengths and weaknesses. 

How do breach response and compliance intersect? 

Breach response often determines whether or not a compliance violation results from a data breach and to what extent. Security teams that detect breaches soon enough, limit the exfiltration adequately enough, and contain the damage aggressively enough can potentially prevent a breach from violating regulatory requirements. And when one does, the difference between a massive fine and public embarrassment versus a minor penalty comes down to breach response. Companies in heavily regulated industries like finance, healthcare, and defense must therefore take breach response very seriously, along with any organization invested in staying on the right side of regulators and keeping the cost of cyber incidents from spiraling out of control. 

How do organizations improve at breach response?

Breach response can always improve, and must as new attacks emerge. Security teams can get better at each stage in the breach response lifecycle through better preparation, training, and by acquiring experience or expertise over time. They can also address one of the primary roadblocks to breach response: the struggle to track stolen information once it has left the organization. That stolen data is the biggest risk in a data breach, making it essential to get better at policing this information. Threat intelligence is the key. Upgrading threat intelligence makes breach response better at every step by replacing assumptions and uncertainty with clarity and context. 

Why is Breach Response Increasingly Important?

How has breach response evolved?

Breach response evolves in reaction to how the threat landscape evolves. As bad actors utilize new tactics, techniques, and protocols, aim at different targets and systems, and reach new lows for ethical conduct, security teams have had to respond in kind or watch their advantage erode. At the same time that breach response has become more standardized over time, it still varies widely across organizations depending on their data footprint, risk exposure, staff mix, and security stack. This evolution will continue, and likely accelerate, as both the offensive and defensive sides of cybersecurity begin embracing AI to supercharge their efforts. 

What are today’s breach response benchmarks?

The efficacy of breach response is traditionally measured in terms of speed—the faster the better. Ideally, it should take 1 minute to detect the breach, 10 minutes to investigate the breach, and 60 minutes to remediate the breach. Realistically, security teams take drastically longer at all three stages, with one estimate suggesting it takes 162 hours on average to resolve an attack following the initial compromise. In addition to being slower than it should, breach response is not accelerating nearly as fast as attack velocity. That finally has the potential to change with the advent of continuous threat exposure management (CTEM) tools designed to help defenders move as fast, or faster, than the attackers. 

What are the challenges of breach response?

• Insufficient Resources: Companies lack the time, tools, and team members necessary to respond immediately to breaches 24/7/365.
• Disconnected Systems: Siloed data sources and manual data collection make it hard to get a clear or complete picture of the incident in progress. 
• Poor Threat Intelligence: Figuring out who launched the attack, how it worked, and what was compromised slows the pace of breach response. 
• Increasing Attack Volume: If breach response was already difficult, more attacks and worse damage makes all the challenges above even harder.  

What is the future of breach response?

Breach response goes wherever attackers go. Automation will likely play a much larger role in the breach response of the future as teams rely on the “all-seeing” capabilities of AI to locate the earliest indicators of compromise and immediately orchestrate the correct response faster and more consistently than a human team ever could. Which doesn’t mean breach response will run entirely on autopilot or that humans will be irrelevant. They will rely on automated threat intelligence to make smarter decisions about stopping the current breach and preventing the next one. 

How Flare Helps With Breach Response

How to use Flare for breach response?

When a cyber attack is in progress, one of the first and most important things security teams must analyze is what sensitive information has been compromised. However, that’s often a time- and labor-intensive undertaking since attackers don’t always leave evidence of what they have infiltrated, forcing security teams to instead scour the internet for company data on leaked data sites or inside hacker communities. Flare automates this discovery process, searching both the clear and dark web while monitoring Telegram channels, to find anything that has been exposed. That way, security teams know exactly what was affected, and they have those insights immediately for a more effective and efficient breach response. 

Can Flare help maintain compliance during breach response?

From GDPR and HIPAA to a raft of other regulations coming down the pipeline at the state, local, and international levels, companies are increasingly expected to prove they are keeping sensitive information secure—before, during, and after an attack. Providing that proof can be a cumbersome process that still leaves regulators unsatisfied. Flare eliminates that obstacle by quickly, clearly, and comprehensively demonstrating what information has—and hasn’t—been breached. It also helps to limit the damage and compliance consequences of anything that has been breached by offering automated takedowns and rich context for remediation and prioritization. A cyber incident does not automatically result in a compliance violation. Breach response determines the outcome. 

Why use Flare for breach response?

The effectiveness of breach response depends on moving quickly, choosing correctly, and acting confidently, and Flare furthers all those objectives:

• Eliminate Manual Processes: Free up time and staff to focus on other aspects of breach response rather than something like dark web monitoring. 
• Accelerate Data Discovery: Know immediately and continually what data, credentials, secrets, or other sensitive information has been exposed. 
• Expand Threat Intelligence: Search wider swatches of the digital world for threat intelligence, and get more context around each discovery. 
• Automate Incident Response: Use automation instead of people to submit takedown requests and limit the damage of any stolen information. 
• Prevent Future Breaches: Consult treat intelligence to make targeted cybersecurity improvements that prevent future breaches before they start. 

Breach Response and Flare

The Flare Threat Exposure Management (TEM) solution empowers organizations to proactively detect, prioritize, and mitigate the types of exposures commonly exploited by threat actors. Our platform automatically scans the clear & dark web and prominent threat actor communities 24/7 to discover unknown events, prioritize risks, and deliver actionable intelligence you can use instantly to improve security. Flare also helps with breach response by quickly finding stolen data and other relevant threat intelligence to minimize the damage, guide the responders, and preserve regulatory compliance. 

Flare integrates into your security program in 30 minutes and often replaces several SaaS and open source tools. Learn more by signing up for our free trial.