Planning and preparing for the unexpected, especially in response to a security incident, is one of the greatest challenges faced by information technology professionals today. An incident is described as any violation of policy, law, or unacceptable act that involves information assets. Incident Response (IR) teams should be evaluating themselves on metrics, such as incident detection or dwell time, to determine how quickly they can detect and respond to incidents in the environment. In a recent year, the SANS Institute surveyed organizations about internal response capabilities. The frequency distribution that summarizes the average time organizations took to detect incidents is:

a. What percentage of organizations took fewer than 2 days, on average, to detect incidents?

b. What percentage of organizations took between 2 and 31 days, on average, to detect incidents?

c. What percentage of organizations took 31 or more days, on average, to detect incidents?

d. What conclusions can you reach about average dwell time of incidents?

Transcribed Image Text:

Average Dwell Time Less than 1 day Between 1 and less than 2 days Between 2 and less than 8 days Between 8 and less than 31 days Between 31 and less than 90 days 90 days or more Source: bit.ly/2oZGXGX. Frequency 166 100 124 77 59 65