Threat monitoring and incident response in a company
Threat monitoring means continuously watching computers, servers, accounts and the network. We describe the tools we use and six incident response steps.
Threat monitoring means continuously watching your computers, servers, accounts and network, so that an attack is detected and handled before it stops your business. Threat monitoring and incident response have two parts: tools that collect events and send alerts, and people who read those alerts and know what to do next. Tools without someone to respond achieve very little.
The protection we deploy in companies is described on our cybersecurity services for businesses page.
Threat monitoring tools
Monitoring relies on four kinds of tools and services:
- endpoint detection and response (EDR) for computers and servers, which records what programs do and blocks suspicious behaviour
- security information and event management (SIEM), a system that collects logs from many devices and combines them into one picture of an event
- availability and performance monitoring for servers, connections and services
- a security operations centre (SOC), a team that reads alerts and responds to them around the clock
A small company rarely needs all four. It usually starts with well-configured protection for computers and servers and availability monitoring. SIEM and round-the-clock alert handling come later, as the number of systems grows or when clients or regulations require them.
What we use
We protect computers and servers with Bitdefender GravityZone and CrowdStrike Falcon. The differences between them are covered in our article Bitdefender vs CrowdStrike. We monitor the availability and performance of infrastructure with Elastic Stack and Grafana.
An alert that needs action goes into our Jira ticketing system and gets a priority like any other ticket. Outside business hours, we handle alerts under an SLA with on-call cover. The other option is the vendor’s managed detection and response (MDR) service, where the vendor’s team reads the alerts.
Incident response step by step
Incident response has six steps:
- Confirm the incident using logs, network traffic and user activity.
- Establish which systems and data are at risk.
- Isolate infected computers or accounts, so the attack cannot spread.
- Remove the malware and close the way the attack got in, for example by changing passwords and installing missing patches.
- Restore the systems, from a backup if necessary, and check that they work correctly.
- Document how the incident unfolded and make changes that prevent similar events.
How quickly you complete the first three steps decides how many computers and how much data the attack reaches. Before any incident happens, decide who may disconnect a computer from the network and block an account, including outside business hours.
If the incident involves personal data, check whether you need to report it to the President of the Personal Data Protection Office (UODO). The notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Art. 33 GDPR).
If you want someone to read the alerts from your computers and servers, talk to us.
