What are the key metrics and indicators to monitor incident trends and patterns?

1 Frequency and Severity

One of the most basic metrics to monitor is the frequency and severity of incidents. Frequency refers to how often incidents occur, while severity measures the impact and damage caused by each incident. By tracking these metrics, you can assess the overall performance of your incident handling process, identify the most common and critical types of incidents, and prioritize your resources and efforts accordingly. You can also compare these metrics over time and across different sources, such as systems, networks, users, or locations, to detect any changes or anomalies that may indicate emerging threats or vulnerabilities.

2 Root Cause and Resolution

Another important metric to monitor is the root cause and resolution of incidents. Root cause refers to the underlying factor or factors that enabled or triggered the incident, such as a misconfiguration, a vulnerability, a human error, or a malicious actor. Resolution refers to the actions taken to contain, eradicate, and recover from the incident, such as isolating the affected systems, patching the vulnerability, restoring the data, or notifying the stakeholders. By tracking these metrics, you can understand the main causes and consequences of incidents, evaluate the effectiveness and efficiency of your incident handling process, and identify any gaps or weaknesses that need to be addressed or improved.

3 Lessons Learned and Recommendations

A third important metric to monitor is the lessons learned and recommendations from incidents. Lessons learned refer to the key findings and insights gained from the incident handling process, such as what worked well, what did not work well, what can be improved, and what can be avoided in the future. Recommendations refer to the specific actions or steps suggested to implement the lessons learned, such as updating the policies, procedures, or tools, enhancing the training or awareness, or conducting audits or tests. By tracking these metrics, you can ensure that you capture and document the valuable knowledge and experience from each incident, and that you apply it to improve your security posture and prevent recurrence.

4 Indicators of Compromise and Indicators of Attack

Besides metrics, you also need to monitor and analyze indicators that can help you detect and respond to incidents. Indicators of compromise (IoCs) are pieces of evidence that indicate that a system or network has been compromised, such as unusual network traffic, suspicious files or processes, or anomalous user behavior. Indicators of attack (IoAs) are signs that indicate that an attacker is actively attempting to compromise a system or network, such as exploit attempts, brute force attacks, or reconnaissance activities. By tracking these indicators, you can identify and verify potential incidents, correlate them with other sources of information, and take appropriate actions to stop or mitigate them.

5 Threat Intelligence and Context

Another type of indicator that you need to monitor and analyze is threat intelligence and context. Threat intelligence is information about the current or emerging threats, actors, tactics, techniques, and procedures (TTPs) that may target your organization or industry. Context is information about the relevance, credibility, and impact of the threat intelligence for your specific environment and situation. By tracking these indicators, you can enhance your situational awareness, anticipate and prevent potential incidents, and tailor your incident handling process accordingly.

6 Feedback and Satisfaction

A final type of indicator that you need to monitor and analyze is feedback and satisfaction. Feedback is the input or opinion from the stakeholders involved or affected by the incident handling process, such as the users, the management, the customers, or the regulators. Satisfaction is the measure of how well the incident handling process met or exceeded the expectations and needs of the stakeholders. By tracking these indicators, you can evaluate the quality and value of your incident handling process, identify any areas of improvement or dissatisfaction, and foster trust and collaboration among the stakeholders.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?