Back To Basics Indispensable Security Processes For Detection And Response

Historical Archive Note: This post was originally published on the Gartner Blog Network on February 8, 2018 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2018/02/08/back-to-basics-indispensable-security-processes-for-detection-and-response/ | Archive.org Snapshot

This post discusses Back To Basics Indispensable Security Processes For Detection And Response, addressing enterprise architecture considerations and operational guidance based on our ongoing research inquiries on the Gartner Blog Network.

In analyzing security operations, detection telemetry, and incident handling workflows, practitioners must carefully balance organizational design, process maturity, and technology automation.

Key takeaways and recommendations:

• Define explicit operational use cases before committing to technology tooling.
• Ensure telemetry normalization and detection engineering feedback loops are established.
• Foster close collaboration between monitoring, detection engineering, and incident response teams.

Related blogs:

• Cloud Security Monitoring!
• Two Essential SIEM Notes