The State of Incident Response
summary
Argues incident response grows urgent because control of IT shrinks (cloud, locked devices), attacks rise in skill and focus, and governments escalate — three trends tied to four economic forces (network effects, fixed vs marginal costs, switching costs, lemons markets) and one psychological bias (prospect theory) that causes chronic underinvestment. Advocates OODA-style observe orient decide act cycles, real‑time IDS/log aggregation, fast secondary tests to clear false positives, and human‑centric tooling; mentions 27 countries with cyber commands and a nascent Code 3 Systems incident management platform effort.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:16Agenda
- 1:11Trends
- 4:18Attack sophistication
- 5:50Advanced persistent threats
- 9:01Government involvement in cyberspace
- 10:54Network effect
- 13:37Switching costs
- 15:52Lockin
- 17:35Lemons Market
- 26:46Security is a process
- 28:41People to technology ratio
- 30:17People processing technology
- 35:26Context
- 37:44Instant Response
- 38:33The Good Stuff
- 40:07Underinvesting
- 41:08Automation
- 42:15Strikeback
- 43:14Government requirements
- 44:27Industry experience
- 45:31Cloud security
- 47:00Risk aversion
- 48:22Resilience
- 50:03Bug bounties
- 52:59Detection
related talks
58mKeynote: The Future of Incident Response
17mIncident Response @ Scale-Building a Next Generation SOC
54mSOCcing: Responding to a Cyber Incident
40mIncident Response – How to Give the Advantage to the Hackers!
51mUnder Pressure: What Cyber Can Learn from First Responders
51mReal World Stories of Incident Response and Threat Intelligence
49mTraining for Incident Response: The Red, the Blue, and the Ugly
18mSurviving the Attack: Planning and Practicing IoT Security Response