Incident detection precursors and incident detection indicators are two important notions for the field of cybersecurity. It is clear that these notions are related to incidents but approach them from different perspectives. The former means the prediction about possible incidents in the future. It is grounded on verified public or private information from specialists in the field, external threats, and cybersecurity intelligence (Van Impe, 2018). One of the possible examples can be information received via email with the threats of foreign hackers. The latter shows that the incident is present now: whether it was already committed or ongoing (Van Impe, 2018). The obvious example is an alert from cybersecurity software indicating the failure of key systems.
To understand the applicability of these two concepts, the 2021 attack on Colonial Pipeline’s network may be a good example to discuss challenges. The major obstacle for incident detection precursors is that cyberattack often happens externally, so an industry has limited capabilities to indicate any signs. For example, the case of Colonial Pipeline shows that attacks may be supervised by FSB, a Russian professional security service (Turton & Mehrotra, 2021). As for incident detection indicators, the challenge is that security software may produce hundreds of security alerts a day, most of which are false. Thus, specialists may miss the real threat and instead focus on solving insignificant problems.
Respond to Classmate’s Post
The post greatly summarized the main information about incident detection precursors and incident detection indicators. I especially liked the example of the company with a great number of indicators and precursors. However, for a deeper understanding of the case, it may be useful to know the output of AI-managed security. Perhaps, it is too risky for such a big company to delegate protection to the software completely, so it is interesting to know what barriers exist during communication of the system with specialists.
References
Turton, W., & Mehrotra, K. (2021). Hackers breached Colonial Pipeline using compromised password.Bloomberg. Web.
Van Impe, K. (2018). Don’t dwell on it: How to detect a breach on your network more efficiently.Security Intelligence. Web.