Insights for CISOs: Digital Forensics

The growing volume and complexity of attacks are a major concern for businesses, governments, academic institutions, and non-profits. Media increasingly report cyberattacks with consequences ranging from ransomware payment to large-scale critical infrastructure disruptions. Although there are countless examples of such events, cybersecurity experts often describe the 2020 SolarWinds hack as one of the largest and most sophisticated attacks. Malicious actors hacked SolarWinds, a provider of IT monitoring and management tools. Hackers remained undetected in the organization's environment for several months and, during that time, distributed malware to SolarWinds clients through software updates. The attack affected thousands of businesses and government agencies across the world. Apart from shedding light on the importance of supply chain security, the SolarWinds hack also showed that organizations with robust security measures failed to discover a compromise for several months. The SolarWinds hack is not exceptional in this sense. An average organization identifies and contains a breach in 287 days. Cybersecurity incidents take place daily. If not discovered and investigated, the consequences of cyber incidents can be especially damaging. The average cost of a data breach reached $4.24 million in 2021. While the business executives begin to recognize cybersecurity as a business enabler, most organizations deploy a reactive mindset. They focus on having an incident response plan to meet compliance and security requirements set by regulators or partners. While some organizations treat the incident response process as a box-ticking exercise, others only view it through the prism of damage control. As a result, organizations often overlook the importance of incident response processes that may not provide an immediate return on investment.