Name: New Techniques to Strengthening Threat Detection and Response
Start: 2021-02-11T00:00:00-07:00
End: 2021-02-11T23:59:59-07:00
Location: Online

How would you describe your current approach to log management?*
- My organization does not centrally collect logs.
- Log collection and retention are primarily driven by audit requirements.
- Log collection is performed from all security devices, networking infrastructure, production servers, applications, and databases.
- Log collection also includes physical security systems and/or highest-value endpoint systems, plus some personal devices.
- Log collection is performed from all systems generating log and audit data.

How would you categorize your security information and event management (SIEM) capabilities?*
- I don’t have a SIEM in place.
- My SIEM is primarily used to demonstrate audit compliance.
- My SIEM is used to monitor for and respond to compliance and security threats.
- My SIEM is used to understand cybersecurity risk across the entire production environment.
- My SIEM is used to understand cybersecurity risk across the entire logical, physical, and social environment.

How would you rate your vulnerability intelligence capabilities?*
- My organization doesn’t have a vulnerability management system (VMS) in place.
- My organization’s VMS scans only the system in scope for compliance.
- My organization’s VMS periodically scans network perimeter systems and highest-risk systems.
- My organization has holistic vulnerability intelligence with basic correlation and workflow integration.
- My organization has holistic vulnerability intelligence, with advanced correlation and automation workflow integration.

How would you categorize your threat intelligence capabilities?*
- My organization doesn’t have any threat intelligence.
- My organization has limited use of open-source threat intelligence.
- My organization has reactive and manual threat intelligence workflow.
- My organization offers indicators of compromise (IOC)-based threat intelligence integrated into analytics and workflow.
- My organization offers industry-specific and internally generated IOC- and TTP-based threat intelligence integrated into analytics and workflow.

How would you describe your organization’s user & entity behavioral analytics (UEBA) capabilities?*
- My organization doesn’t have any specific monitoring of user activity.
- My organization monitors privileged users.
- My organization conducts scenario-based monitoring of all users for known bad activity.
- My organization uses real-time UEBA to monitor trends and patterns.
- My organization uses real-time forensic monitoring deployed on every production server and user workstation in the environment in combination with UEBA.

How would you rate your organization’s endpoint analytics?*
- My organization doesn’t offer endpoint monitoring.
- My organization’s endpoint monitoring is deployed on a limited number of servers within compliance scope.
- My organization has real-time forensic monitoring, including FIM and process monitoring, and deploys it to some production servers.
- My organization has real-time forensic monitoring, including FIM and process monitoring, and deploys it to all production servers.
- My organization’s real-time forensic monitoring is deployed on every production server and user workstation.

How would you describe your organization’s level of network analytics?*
- My organization doesn’t have a network forensic solution.
- My organization uses ad-hoc packet capture for troubleshooting.
- My organization uses ad-hoc packet capture used for after-the-fact analysis.
- My organization has real-time network forensic monitoring solutions deployed at internet egress points.
- My organization has real-time network forensic monitoring solutions deployed at multiple locations.

How advanced is your organization’s incident-management toolset?*
- My organization doesn’t have any tools for incident management.
- My organization makes its best efforts for incident management.
- My organization has disparate tools and systems to manage incidents.
- My organization has security tools integrated with a centralized help-desk-style ticketing platform.
- My organization has a centralized incident management platform with rapid access to all log data. My organization has secure storage for evidence and case management workflow.

How much does your organization use holistic analytics?*
- My organization doesn’t offer analytics applied to log data.
- My organization has real-time analytics on exception-based data to detect compliance violations.
- My organization has real-time scenario-based analytics corroborated across log source types.
- My organization has real-time scenario-based analytics across all systems and behavior-based analytics for targeted use cases.
- My organization uses detailed mapping and implementation of both scenario- and behavior-based analytics across wide-ranging data sources for holistic security analytics.

At what level does your organization use orchestration and automation?*
- My organization doesn’t have any tools for orchestration and automation.
- My organization offers limited internal automation of SIEM tooling.
- My organization has basic automation to improve the efficiency and speed of threat investigation and incident response processes.
- My organization has extensively automated threat qualification, investigation, and response processes.

How would you rate your organization’s people and processes?*
- My organization doesn’t have any trained or skilled security analysts.
- My organization does ad-hoc monitoring and response on a best effort basis. There are some formal processes.
- My organization has basic processes for monitoring alarms and responding to security incidents and tiered responsibilities. My organization may have an outsourced incident response capability.
- My organization has formal playbooks document processes and gathers basic metrics. My organization has an 8x5 virtual or physical SOC that provides “eyes-on-the glass,” and delivers centralized orchestration of threat analysis and incident response.
- My organization has advanced operational metrics and reporting and continually reviews processes. My organization has a 24x7 virtual or physical SOC that provides “eyes-on-the glass” and delivers centralized orchestration of threat analysis and incident response.

Online

Dated Zero Trust in 2020? Make a Commitment in 2021!

New Techniques to Strengthening Threat Detection and Response

Products

Solutions

Resources

Partners

Support

Company

Awards & Recognition

Connect with Us

Support

Sales