The basics of user awareness, asset and vulnerability management, and secure configurations continue to serve as the foundation for a strong cybersecurity programme. CrowdStrike recommends that organisations regularly review and improve their standard security controls, including the following: user awareness, asset management, vulnerability and multifactor authentication.
With breakout time measured in hours, something that is worth remembering when countering threats is the “1-10-60 rule”. This rule is divided as such; detect intrusions in under one minute, perform a full investigation in under 10 minutes and eradicate the adversary from the environment in under 60 minutes.
Those organisations that meet this 1-10-60 benchmark are much more likely to eradicate the adversary before the attack spreads out from its initial entry point, minimising impact and further escalation. Meeting this challenge requires investment in deep visibility, as well as automated analysis and remediation tools across the enterprise, reducing friction and enabling responders to understand threats and take fast, decisive action