What are the five "pitfalls" of incident response?

Pitfall 1: Is it okay because SOC is watching?

・SOC monitoring scope is partial

・It is necessary to expand the investigation scope using IR and neutralize the attack.​

Pitfall 2: Is it okay because you can "contain" it yourself?

・There are gaps in the customer's own "containment"

・IR experts are needed to neutralize attacks and prevent damage from spreading​

Pitfall 3: Is it okay because we have a CSIRT system?

・CSIRT managers/staff are not IR experts

・A second opinion from an IR expert is effective

Pitfall #4: “There’s no budget” so there’s no other way?

・IR tends to require a large upfront investment

・ A reasonably priced service that focuses on neutralizing attacks is effective

Pitfall 5: Should you wait until an incident occurs before signing an IR contract?

・The damage will increase while searching for an IR vendor

-Need smooth attack nullification with pre-contract​

Macnica and Blackpanda support "initial incident response"

IR experts will implement measures to neutralize the attack and prevent damage from spreading.