Threat detection and response

In this article, learn about threat detection and response, along with examples of cyber threats and how threat intelligence is used to respond to threats. See how to take a proactive approach to threat detection.

What is threat detection and response?

Threat detection and response is a set of cybersecurity practices and tools to identify malicious activities and neutralize or mitigate them before networks, systems, or sensitive data are compromised.

The most effective threat detection and response is executed using a blend of technology, processes, and people.

What is threat detection?

There are two broad categories of threats—known and unknown. A threat detection strategy must employ the following capabilities to identify both attack types effectively.

1. Endpoint threat detection
   Identifies potentially malicious events on users’ systems, such as desktops, Internet of Things (IoT) devices, laptops, smartphones, servers, tablets, and workstations.
2. Network threat detection
   Establishes normal traffic patterns on the network and monitors for anomalies.
3. Security event threat detection
   Aggregates data from events across the network, including authentication, network access, and system logs.
4. Penetration testing
   Simulates attacks on systems to evaluate security and identify vulnerabilities.

The following are three key threat detection methods.

1. Behavior-based threat detection
Behavior-based detection methods identify abnormal behavior that could indicate activity on devices or networks. With this threat detection model, baselines for normal behavior patterns, such as where a user usually logs in from, what time of day they are online, and what resources they access, are developed and regularly updated. If behavior deviates from established patterns, a flag is raised, sending an alert about potentially malicious activity.

2. Machine learning-based threat detection
Vast amounts of data from a variety of sources, such as log files, security systems, and cloud services are processed through machine learning models. Machine learning algorithms use statistics and probability to quickly recognize patterns that would be impossible for humans to detect. Generating insights from across the attack surface, machine learning threat detection plays a critical role in identifying unknown threats.

3. Signature-based threat detection
Signature-based threat detection approaches scan network traffic for indicators of known threats (e.g., hashes, names of files, registry of key names, or strings that show up in a file). When a match is found, an alert is generated.

What is threat response?

Following threat detection, threat response consists of the steps taken to minimize the impact of cyber attacks and other malicious activities. Effective threat response depends on having a detailed plan in place to enable teams to act quickly.

Threat response plans should detail roles and responsibilities. The people involved in threat response are referred to as a cyber incident response team (CIRT). CIRTs usually include representatives from across the enterprise (e.g., security and IT, executives, legal, human resources, compliance, risk management, and public relations).

Following are six steps for effective threat response.

1. Preparation
The efficacy of threat response is predicated on preparedness. This means creating and regularly reviewing all aspects of the threat response plan to ensure the steps can be quickly followed and address the most current threat landscape. This preparation should include strategy, policies, and plans to minimize disruption and damage.

2. Identification and analysis
Threat detection identifies incidents using data from various sources, such as log files, monitoring tools, error messages, intrusion detection systems, and firewalls. After threat detection, analysis should be conducted to understand its exact nature and the scope of the attack. This information ensures the most effective response.

3. Containment
Containment efforts should start as soon after threat detection as possible. To this end, there are two phases of containment:

1. Short-term—Containment measures focus on isolating the affected systems to stop the threat from spreading. Often, infected devices are moved offline.
2. Long-term—Containment measures are expanded to shore up defenses for protecting unaffected systems. Sometimes, sensitive resources are physically separated with network segmentation.

4. Eradication
During the eradication phase, the team must search for and remove all traces of the threat from affected and unaffected systems. This may involve destroying malware, deploying patches, rebuilding systems from backups, or taking systems out of production permanently.

5. Recovery
Before systems are returned to production, they are tested, monitored, and validated to confirm that eradication steps were effective. For larger incidents, the recovery phase also includes deciding when to reinstate operations. In some cases, unaffected systems will return to production first, with infected systems being subjected to additional testing.

6. Post-incident review
Once the threat has been handled and all operations have been restored, a team examines evidence gathered during each threat response step to understand what happened and how it can be prevented moving forward. Lessons learned are shared with internal teams and often with third parties to help others avoid a similar situation. One resource for reporting cybercrime is the FBI’s Internet Crime Complaint Center, or IC3, the Nation’s central hub for reporting cybercrime that collects threat-related data.

Examples of cyber threats

Awareness of the types of cyber threats organizations face is critical for threat detection and response. Some of the most common threats include:

1. Advanced persistent threats (APT)
2. Distributed Denial-of-Service (DDoS) attacks
3. Insider threats—malicious and negligent
4. Malware
5. Phishing
6. Social engineering
7. Ransomware
8. Supply chain attacks
9. Zero-day threats

How threat intelligence is utilized

Threat intelligence is collected, processed, and analyzed to provide insights into motives, targets, and attack behaviors. Security decisions can be made more quickly and change from reactive to proactive. Examples of threat intelligence data include:

1. Advice about how to defend against attacks
2. Anomalous behavior
3. Attack tactics, techniques, and procedures (TTPs)
4. Known threats and attackers
5. Motivations for an attack
6. Origin of an attack
7. Types of malware or attacker infrastructure
8. Unknown threats and attackers
9. Vulnerabilities

Responding to security incidents

Speed is critical when responding to a security incident. The time from threat detection to containment should be as short as possible to minimize the damage.

As detailed above, a threat response plan should be a top priority for every organization. No matter the size, every organization is susceptible to a cyber attack and will suffer if it is not handled quickly and effectively.

Questions to review and address to ensure the most proactive response to a security incident include:

1. Are teams in place to respond to threat detection alerts?
2. Do teams know who is responsible for each phase of the threat response plan?
3. Is a communications chain in place, and is it well understood by all team members?
4. Are the terms for escalation clear to all team members?
5. Are all the tools and systems in place to quickly respond to threat detection alerts?

Proactive threat detection

Proactive threat detection depends on making the most of the capabilities of technology and people. The tools provide automation to eliminate tedious manual tasks and elevate threat detection beyond what people can perform. The human element provides the ability to see nuances and apply decision-making that machines cannot.

Important resources that can be used for proactive threat detection include:

1. Artificial intelligence (AI) and machine learning-powered solutions
2. Continuous monitoring and analysis
3. Penetration testing
4. Proactive threat detection and response plans and teams
5. Threat hunting

The vital role of threat detection and response

Most experts agree that threat detection and response is a must-have for any organization. The depth and breadth of these systems varies based on the type and size of the enterprise and the information it collects, uses, and stores. The good news is that solutions are available to meet any organization's specific requirements.

Take control of your cloud platform.

Learn more about SailPoint Identity Security.