{"id":45263,"date":"2022-02-11T21:12:31","date_gmt":"2022-02-11T21:12:31","guid":{"rendered":"https:\/\/www.darkreading.com\/crowdstrike\/seven-key-ingredients-to-effective-incident-response"},"modified":"2022-02-11T21:12:31","modified_gmt":"2022-02-11T21:12:31","slug":"seven-key-ingredients-to-effective-incident-response","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/seven-key-ingredients-to-effective-incident-response\/","title":{"rendered":"Seven Key Ingredients to Effective Incident Response"},"content":{"rendered":"
<\/div>\n

Ransomware has evolved as a menacing way for threat actors to exploit organizations. It\u2019s important to remember that today\u2019s widespread ransomware attacks are very different from those of recent years in terms of scale and potential for damage. We are really not in Kansas anymore.<\/p>\n

As ransomware attacks have evolved, so should your incident response (IR) and recovery process \u2014 specifically, one developed around seven key ingredients that deliver IR efficacy.<\/p>\n

Problems With a Traditional IR Approach
<\/strong>Ransomware is not a new threat; however, approaches to remediation have changed as attacks have grown.<\/p>\n

In the past, attacks were often confined to a few manageable endpoints, so a full remediation to reimage, rebuild or even replace affected systems made sense. Further, remediation efforts have historically lacked the visibility necessary to undo an attacker\u2019s specific actions, leading to a default belief that the only way to eradicate a threat is to reimage, rebuild or replace the systems. This process also required boots on the ground to execute a strategy often flawed by the threat of reinfection from the backup copy.<\/p>\n

Unfortunately, the frequency and scale of ransomware attacks have increased\u20145,000 systems affected by ransomware in an environment is not uncommon these days\u2014making this legacy approach costly, time-consuming and exhausting to all parties involved in the response.<\/p>\n

When an enterprise\u2019s endpoints might be spread across the globe, an onsite response for every endpoint is not practical or cost-effective. It is a race against time for today\u2019s Chief Information Security Officers (CISOs), who cannot afford to disrupt the business whenever such an incident takes place.<\/p>\n

An alternative accelerated IR approach is becoming increasingly necessary to avoid business downtime. This approach has been used successfully to contain widespread attacks and recover systems with speed and precision. It is made up of the following seven key ingredients:<\/p>\n