CrowdStrike on Dark Reading: Why “Breakout Time” Is Critical to Your Security Strategy

The following are some excerpts from the article:

As the targeting of public and private industries continues to plague organizations worldwide, it's obvious that security must be raised to a board-level issue as organizations look to justify increased investment in cybersecurity.

CrowdStrike recently highlighted a new cyber metric based on insights from its 2018 Global Threat Report called "breakout time." Data was compiled from 30 trillion security events collected in 2017 to analyze attacker trends and to develop best-practice recommendations. Breakout time can be used to understand and contextualize the effectiveness of an enterprise security program.

So, what is breakout time? It's the time it takes for an intruder to begin moving laterally outside of the initial beachhead to other systems in the network. The average breakout time analyzed over the previous year came in at one hour and 58 minutes — that's the tight window during which an organization can prevent an incident from turning into a breach.

Breakout time is so important because the initial machine the intruder compromises is almost never the one he (or she) needs to fulfill his or her objective. The adversary must move laterally so he can burrow deep into the network, perform reconnaissance, and find his targets. One hour and 58 minutes dictates how much time the organization has to detect and eject the intruder. That's why it's important to focus on speed when assessing the effectiveness of any security capability.