Adopting proactive mobilization

To begin with, incidents should not take organizations by surprise. For instance, when a customer calls to complain about an unavailable service or a phishing email, significant damage has already been done to the company. Therefore, organizations need to adopt proactive mobilization to handle incidents at the earliest possible points to minimize disruption to the business. This implies that organizations have to use telemetry and collect data from various attack surfaces. While monitoring networks and hardware for threats might be helpful, in service industries, there is a need to monitor application performance or usage patterns to get wind of a security event as early as possible. This is because there might be a gap between what security monitoring tools can keep an eye on and all the surface areas that might be attacked by hackers.

Once an organization's security monitoring process is adequate, the next point of focus should be the response...