Security: Incident response is everything

This year so far has had a number of information security incidents that have cost likely billions of dollars, and they've cost even more as damage to the reputations of some well-known businesses. US retailer Target, Home Depot, Apple, Sony, JP Morgan Chase, and the list goes on.

But for each attack that makes the mainstream news headlines, such as the Russian attack on JP Morgan, there are at least thousands or possibly millions of attacks that don't make the news. They usually affect smaller businesses and institutions, but there are many, many more of them.

According to the 2014 Symantec Internet Security Threat Report, in 2013:

Website, web database, and point-of-sale system attacks caused the identities of 552 million users to be stolen, with an average of 2,181,891 identities per breach. 552 million online identities is nearly one in five of the roughly 2.8 billion people estimated to use the Internet that year.

One in 196 emails was estimated to contain malware.

One in 566 websites were estimated to contain malware.

351 web browser vulnerabilities were found in Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Apple Safari, and Opera. As most lesser known web browsers share a layout engine, such as WebKit, Gecko, or Trident with one of the top five web browsers, many vulnerabilities that affect a major web browser also affect many less common web browsers.

Something as simple as a single malware file, malicious email, or network vulnerability can cost a business a lot of money in stolen data, litigation, or even mere computer and network downtime. All businesses with computer networks are at risk of information security attacks.

Prevention is indeed the best medicine. Creating and enforcing a well-designed IT security policy makes your business less likely to be subject to attacks, and less often. But absolutely nothing can be made 100% secure.

So, the perfect complement to sound prevention with a good IT security policy is well prepared incident response. A well trained and vigilant Computer Security Incident Response Team is crucial.

See more here:
Security: Incident response is everything