The State of Incident Response

Explore the economic and psychological forces shaping incident response in cybersecurity through this 55-minute Black Hat conference talk. Delve into trends like attack sophistication, advanced persistent threats, and government involvement in cyberspace. Examine network effects, switching costs, and the "lemons market" in security. Understand why security is a process, the importance of people-to-technology ratios, and the role of context in incident response. Investigate instant response techniques, automation, strikeback strategies, and government requirements. Learn about industry experience, cloud security challenges, risk aversion, resilience, and bug bounties. Gain insights into detection methods and the potential for incident response to address persistent network vulnerabilities.

Introduction
Agenda
Trends
Attack sophistication
Advanced persistent threats
Government involvement in cyberspace
Network effect
Switching costs
Lockin
Lemons Market
Security is a process
People to technology ratio
People processing technology
Context
Instant Response
The Good Stuff
Underinvesting
Automation
Strikeback
Government requirements
Industry experience
Cloud security
Risk aversion
Resilience
Bug bounties
Detection