Despite implementing cybersecurity administrative and technical risk mitigation control, companies still experience cybersecurity incidents and data breaches. Not every security incident ends with data exfiltration. An organization that can contain the attacker early in the kill chain can prevent data loss and reduce the incident’s impact.
The term Tactics, Techniques and Procedures (TTP) describes the behavior of a threat actor and a structured framework for executing a cyberattack. The actors can range from hacktivists and hobbyist hackers to autonomous cybercriminals, underground rings and state-sponsored adversaries. By understanding the Tactics, Techniques and Procedures involved in a cyberattack kill chain, businesses can discover, evaluate and respond to security threats with a proactive approach. Let’s take a look.
More and more organizations are abandoning the outdated waterfall development methodology for more practical and efficient Agile development practices. As this movement has occurred, development teams are moving faster than ever by employing Continuous Integration (CI) and Continuous Deployment (CD) practices that are serving to shorten development cycles and get new features into production faster. This does, however, come with greater security risk in some respects.
Data anonymization is becoming an increasingly prominent and important concept for businesses of all sizes. Whether it’s to protect customer data or satisfy regulatory requirements, data privacy remains a top priority for organizations worldwide.
In our last RBA blog post, we introduced the Splunk RBA journey and how to plan for a successful implementation. In this post, we dive deeper into the four levels of this journey. One of the things I've discovered in working with Splunk customers is that there is a big difference between an initial trial of RBA and using it effectively in a production environment.
The Security Operations Center (SOC) is the central unit that manages the overall security posture of any organization. Knowing how your SOC is performing is crucial, so security teams can measure the strength of their operations. This article describes SOC metrics, including their importance, common SOC metrics, and the steps SOC teams can take to improve them.
